Can't get access token with nextjs-auth0 with the audience set

[tyf]

Hey @diego.diaz !

@diego.diaz

// app/api/auth/[auth0]/route.js
import { handleAuth, handleLogin } from '@auth0/nextjs-auth0';

export const GET = handleAuth({
    login: handleLogin({
        authorizationParams: {
            audience: 'https://anonymized.us.auth0.com/userinfo', // or AUTH0_AUDIENCE
            // Add the `offline_access` scope to also get a Refresh Token
            scope: 'openid profile email offline_access read:products' // or AUTH0_SCOPE
        }
    })
});

You shouldn’t be passing the /userinfo url as an audience, it will automatically be added to access tokens. I believe with the current set up the authorization server is just ignoring the audience param altogether so you’re receiving an opaque token, thus the empty payload.

You’ll want to pass in the identifier/audience of your API you registered in Auth0 instead.

More on the audience param can be found here:

What is the Audience?

Question: What is the Audience? Answer: The audience parameter exists as part of the OAuth2.0 protocol. You can read more information from the specification here. What is it? The audience (presented as the aud claim in the access token) defines the intended consumer of the token. This is typically the resource server (API, in the dashboard) that a client (Application) would like to access. It can be added to the request to authorize i.e. audience: 'https://test-api' Here is an example where …

Aside from that, everything looks good!