# Getting access token with audience(my API identifier) defined in my SPA, but aud decoded is still clientID of my SPA

**URL:** <https://community.auth0.com/t/getting-access-token-with-audience-my-api-identifier-defined-in-my-spa-but-aud-decoded-is-still-clientid-of-my-spa/40499>\
**Category:** JWT.io\
**Tags:** api\
**Created:** [April 3, 2020, 10:07pm UTC](https://community.auth0.com/t/getting-access-token-with-audience-my-api-identifier-defined-in-my-spa-but-aud-decoded-is-still-clientid-of-my-spa/40499 "2020-04-03T22:07:38Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![siyuewang.nina](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/siyuewang.nina/32/13131_2.png) [@siyuewang.nina](https://community.auth0.com/u/siyuewang.nina)\
**Post date:** [April 3, 2020, 10:07pm UTC](https://community.auth0.com/t/getting-access-token-with-audience-my-api-identifier-defined-in-my-spa-but-aud-decoded-is-still-clientid-of-my-spa/40499/1 "2020-04-03T22:07:38Z")

</div>

I am using reactjs for front end, hosting on localhost:3000  
and localhost:8080 for spring boot backend  
I’m doing `const token = await getTokenSilently({"audience":"http://localhost:8080/api"});`  
I also tried by adding audience to context provider when initializing auth0client.  
I’m not able to authenticate when accessing api since the audience in the token is still my react SPA clientID.  
Anyone know why? Did I configure anything wrong?

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [April 6, 2020, 6:17pm UTC](https://community.auth0.com/t/getting-access-token-with-audience-my-api-identifier-defined-in-my-spa-but-aud-decoded-is-still-clientid-of-my-spa/40499/3 "2020-04-06T18:17:39Z")

</div>

Hi @siyuewang.nina,

Welcome to the Community!

Can you DM me your tenant name so I can take a look at your config?

Thanks,  
Dan

---

<div class="post-metadata">

**Author:** ![siyuewang.nina](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/siyuewang.nina/32/13131_2.png) [@siyuewang.nina](https://community.auth0.com/u/siyuewang.nina)\
**Post date:** [April 6, 2020, 7:36pm UTC](https://community.auth0.com/t/getting-access-token-with-audience-my-api-identifier-defined-in-my-spa-but-aud-decoded-is-still-clientid-of-my-spa/40499/4 "2020-04-06T19:36:18Z")

</div>

Hi, would it be caused by I’m hosting my SPA on local host? From the documentation I’ve seen,we are not able to use getTokenSilently on localhost. I tried using getTokenWithPopup, and it worked fine, while getTokenSilently returned me an opaque token.

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [April 6, 2020, 8:14pm UTC](https://community.auth0.com/t/getting-access-token-with-audience-my-api-identifier-defined-in-my-spa-but-aud-decoded-is-still-clientid-of-my-spa/40499/5 "2020-04-06T20:14:25Z")

</div>

Can you try `getTokenSilently({audience:"http://localhost:8080/api"})`

---

<div class="post-metadata">

**Author:** ![siyuewang.nina](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/siyuewang.nina/32/13131_2.png) [@siyuewang.nina](https://community.auth0.com/u/siyuewang.nina)\
**Post date:** [April 6, 2020, 8:57pm UTC](https://community.auth0.com/t/getting-access-token-with-audience-my-api-identifier-defined-in-my-spa-but-aud-decoded-is-still-clientid-of-my-spa/40499/6 "2020-04-06T20:57:35Z")

</div>

Hi if I do that, I’ll get an object that is like:

\_\_raw: “**"  
given\_name: “Siyue”  
family\_name: “Wang”  
nickname: “siyuewang.nina”  
name: “Siyue Wang”  
picture: “[https://lh5.googleusercontent.com/-5ErD5xF-fIM/AAAAAAAAAAI/AAAAAAAAAAA/AAKWJJPLDwOVESLiRIDveQLRiTmN8jQZ3w/photo.jpg](https://lh5.googleusercontent.com/-5ErD5xF-fIM/AAAAAAAAAAI/AAAAAAAAAAA/AAKWJJPLDwOVESLiRIDveQLRiTmN8jQZ3w/photo.jpg)”  
locale: “en”  
updated\_at: “2020-04-06T20:52:11.720Z”  
email: "**”  
email\_verified: true  
iss: “[https://dev-k0v-ggvx.auth0.com/](https://dev-k0v-ggvx.auth0.com/)”  
sub: “google-oauth2|113479079528742309735”  
aud: “YK3uS2H6qJio7Eh642WhzQHddawvW3AN”  
iat: 1586206332  
exp: 1586242332  
nonce: “e\_SaCQCtErJuKOOlDz8Uzq0ClvjpCUQccME5RBMJWBA”

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [April 8, 2020, 10:06pm UTC](https://community.auth0.com/t/getting-access-token-with-audience-my-api-identifier-defined-in-my-spa-but-aud-decoded-is-still-clientid-of-my-spa/40499/7 "2020-04-08T22:06:24Z")

</div>

So it doesn’t look like an opaque token, just that your identifier is not coming through correctly. Can you try to register the API as something other than localhost then use that as the aud? for example, `https://expenses-api`

---

<div class="post-metadata">

**Author:** ![dan.woda](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dan.woda/32/18340_2.png) [@dan.woda](https://community.auth0.com/u/dan.woda)\
**Post date:** [April 23, 2020, 2:16am UTC](https://community.auth0.com/t/getting-access-token-with-audience-my-api-identifier-defined-in-my-spa-but-aud-decoded-is-still-clientid-of-my-spa/40499/8 "2020-04-23T02:16:40Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
