Getting RS256 token instead of HS256

[tyf]

No problem I’m happy to help where I can and thanks for following up!

I’d be curious as to the need for HS256 in your use case? The default (and recommended) signing algorithm is RS256 as you’ve noticed. Some more on signing algorithms in particular can be found in this FAQ:

RS256 vs HS256 JWT signing algorithms

Question: What’s the difference between RS256 and HS256 JWT signing algorithms? TLDR; RS256 and HS256 are algorithms used for signing a JWT. RS256 is an asymmetric algorithm, meaning it uses a public and private key pair. HS256 is a symmetric algorithm, meaning it uses a shared secret. Auth0 uses RS256 as the default signing algorithm in JWTs. We recommend that you use RS256 instead of HS256 for several reasons. Answer RS256 and HS256 are two algorithms used for signing a JSON Web Token …

@giovannilaperna

If I create a new API, I can choose a HS256 Signing Algorithm, but I have also to provide a new Identifier and I have no idea how to choose it.

Which URL should I provide?

When registering an API in Auth0 the identifier is typically the URL of the API that the API as it exists in Auth0 represents. Basically, you would use this identifier as the audience in an authorization flow where the token returned is verified on your end for said API. The following article goes into more detail regarding the validation of Access Tokens by an API:

Validate Access Tokens

Hope this helps at least clear things up a bit!