# Auth0Web for Flutter ignoring audience and scope

**URL:** <https://community.auth0.com/t/auth0web-for-flutter-ignoring-audience-and-scope/116954>\
**Category:** Get Help\
**Tags:** login-experience, new-universal-login-experience\
**Created:** [September 22, 2023, 5:14pm UTC](https://community.auth0.com/t/auth0web-for-flutter-ignoring-audience-and-scope/116954 "2023-09-22T17:14:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![zeebzog](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/zeebzog/32/13136_2.png) [@zeebzog](https://community.auth0.com/u/zeebzog)\
**Post date:** [September 22, 2023, 5:14pm UTC](https://community.auth0.com/t/auth0web-for-flutter-ignoring-audience-and-scope/116954/1 "2023-09-22T17:14:14Z")

</div>

I have created a single page application, and initially using a python flask app I wrote logged in using the universal login, setting the audience and scope, using the Auth0 flask integration. This works and returns a JWT with the expected details.

I have tried to recreate in Flutter for a Web App. I have used:  
package:auth0\_flutter/auth0\_flutter.dart  
package:auth0\_flutter/auth0\_flutter\_web.dart

And I can login the user from the universal login, however I cannot successfully set an audience or the scopes I require.

The code I have used is:

final Auth0Web auth0Web = Auth0Web(AUTH0\_DOMAIN, AUTH0\_CLIENT\_ID);

When login is pressed I call:

{  
return auth0Web.loginWithRedirect(  
redirectUrl: WEB\_URL,  
audience: AUTH0\_AUDIENCE,  
scopes: AUTH0\_SCOPES);  
}

Where scope is along the lines of:

const Set AUTH0\_SCOPES = {  
‘openid’,  
‘profile’,  
‘email’,  
‘access:Administration’  
};

and Audience is:

const String AUTH0\_AUDIENCE = “[https://API](https://API)”;

This does not set the audience or scopes and the bearer token I get back is opaque.  
Am I doing anything wrong, or have I missed a step somewhere, or is this a bug?

Thank you for any and all help.

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [September 28, 2023, 11:45pm UTC](https://community.auth0.com/t/auth0web-for-flutter-ignoring-audience-and-scope/116954/3 "2023-09-28T23:45:25Z")

</div>

Hey there @zeebzog!

Thanks for the detailed description!

While it’s difficult for me to know what the issue could be in your app code, I was able to test this in our [sample app](https://github.com/auth0-samples/auth0-flutter-samples/tree/main/sample) and can confirm that I am receiving a JWT as opposed to an opaque token. Perhaps you can pull that down and configure to your own environment for comparison purposes?

My `audience` and `scopes` are defined in [example\_app.dart](https://github.com/auth0-samples/auth0-flutter-samples/blob/main/sample/lib/example_app.dart) as follows:

```auto
Set<String> scopes = {'openid', 'profile', 'email', 'access:Administration'};
const String audience = "https://my-api-endpoint";

```

And my login function looks like this:

```auto
  Future<void> login() async {
    
    try {
      if (kIsWeb) {
        return auth0Web.loginWithRedirect(redirectUrl: 'http://localhost:3000', audience: audience, scopes: scopes);
      }

      var credentials = await auth0
          .webAuthentication(scheme: dotenv.env['AUTH0_CUSTOM_SCHEME'])
          .login(audience: dotenv.env['AUTH0_AUDIENCE']);

      setState(() {
        _user = credentials.user;
        print(credentials.accessToken);
      });
    } catch (e) {
      print(e);
    }
  }

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [October 12, 2023, 11:46pm UTC](https://community.auth0.com/t/auth0web-for-flutter-ignoring-audience-and-scope/116954/4 "2023-10-12T23:46:23Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.