# Empty JWT payload in api request header

**URL:** <https://community.auth0.com/t/empty-jwt-payload-in-api-request-header/99366>\
**Category:** Get Help\
**Tags:** apis, application\
**Created:** [January 31, 2023, 11:18am UTC](https://community.auth0.com/t/empty-jwt-payload-in-api-request-header/99366 "2023-01-31T11:18:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![qcgilbert](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/qcgilbert/32/44104_2.png) [@qcgilbert](https://community.auth0.com/u/qcgilbert)\
**Post date:** [January 31, 2023, 11:18am UTC](https://community.auth0.com/t/empty-jwt-payload-in-api-request-header/99366/1 "2023-01-31T11:18:19Z")

</div>

Hello,

I’m trying to connect my Angular SPA to my Auth0 custom API. The API server (hosted locally) works with curl, however when making the request through Angular I get invalid\_token (as logged at the server). Decrypting the token on [JWT.io](http://JWT.io) reveals there is no payload data. Below is the relevant parts of my code.

app.module.ts

```auto
AuthModule.forRoot({
      domain: config.domain,
      clientId: config.clientId,
      authorizationParams:{
        redirect_uri: window.location.origin,
        audience: 'https://localhost:4200'
      },
      httpInterceptor: {
        allowedList:[{
          uri: 'https://localhost:4200/api/*',
          tokenOptions: {
            authorizationParameters: {
              audience: 'https://localhost:4201/api/'
            }
          }
        }],
      }

```

api.service.ts

```auto
@Injectable({
    providedIn: 'root'
})

export class ApiService {   
    constructor (private http: HttpClient) { }

    ping() {
        this.http.get( "https://localhost:4200/api/user/private").subscribe({
          next: (v)=> console.log(v),
          error: (e) => console.log(`error: ${e.error}`),
          complete: () => console.log("API request complete.")
        });
    }

}

```

The reason the httpInterceptor allowedList uri is set to port 4200 is that I am using Angular’s proxyConfig in order to manage the CORS between the local front end and backend server. I have verified that my credentials for domain and clientId match my application in my Auth0 account. I also verified that the audiences (the AuthService for my SPA, and the httpIntercept for my API) are correct.

Any thoughts or insights would be greatly appreciated. Thank you!

---

<div class="post-metadata">

**Author:** ![qcgilbert](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/qcgilbert/32/44104_2.png) [@qcgilbert](https://community.auth0.com/u/qcgilbert)\
**Post date:** [February 4, 2023, 5:49pm UTC](https://community.auth0.com/t/empty-jwt-payload-in-api-request-header/99366/2 "2023-02-04T17:49:18Z")

</div>

I solved this problem. The audience key should be a part of the AuthModule parameters, not in the authorizationParams.

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [February 6, 2023, 10:39am UTC](https://community.auth0.com/t/empty-jwt-payload-in-api-request-header/99366/3 "2023-02-06T10:39:13Z")

</div>

Wooohoo! Thanks for sharing it with the rest of community!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [February 20, 2023, 10:40am UTC](https://community.auth0.com/t/empty-jwt-payload-in-api-request-header/99366/4 "2023-02-20T10:40:04Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.