How to decode tokens in v4 middleware

Ready to post? :mag: First, try searching for your answer.
In v3 I was able to use jwt.decode and fetch the roles and permissions off my access token in the middleware, I’ve upgraded to v4 and i am not able to do that anymore. I believe I am getting a JWE instead now. Even though I don’t have encrypted tokens toggled on in the console for the API of my Nextjs application.

Hi @dfranco,

Welcome to the Auth0 Community!

This video might be of help.

Make sure you include the audience when you request the token.

If you have any other questions, feel free to let us know.

Have a good one,
Vlad

Is there an example for decoding the accessToken in the new middleware? You can get the access token like this
const token = await auth0.getAccessToken() , but I run into the decoding issue even though I still have the AUTH0_AUDIENCE ENV variable from v2

AUTH0_AUDIENCE=
AUTH0_DOMAIN=
AUTH0_CLIENT_ID=
AUTH0_CLIENT_SECRET=
APP_BASE_URL=
AUTH0_SECRET=

Make sure that the jwt library is up to date. You can find it in the following link:

Here should be an example of how to use it:

Let us know if this solves the issue.

Have a good one,
Vlad


I attempted the library above, and these are my token settings. It still seems like I’m receiving a non JWT token like below. Am I missing an env variable or missing a newer config needed to decrypt the accessToken received in the new v4 auth0/nextjs-auth0?

eyJhbGciOiJkaXIiLCJlbmLiOiJCMjU2R0NNIiwiaXNzIjoiaHR0cHM6Ly9kZXYtcTUzYy11c28uYXV0aDAuY29tLyJ9…-Mf7jFo4Ly_PUtG-.ImMEmG4v7Og
5ZQAttZMjcsoeS3LBehH8qJhI_sAIVa3KjFv_b5q21gcZ6fbO1DtMoXJdxNuileeylsf3l2bRds6c-a5JzeKRl18Pggd0boRD6Q1cvSVmJx8eJa0m4sloLafKSNvfn1PsTgf1qMImk
DTnZoglbm_5eooUkZXrTXonBCSTaLaS9WBRHKzI__9xxv4zeKavREzwd1ffP8-v65HUIiiaXwUwqMonl001Z9QZ4KKpAaTvQdmULI8RoYWP-QCPs6my0jZdZGB0uiTzfHycphzrmxY
DLARk_5-GBY4yTVVU2l1-hdvyp2c-shICYJ0CJ-8_hOD87KIRh6C-O34Mpwj5UQjnd4BlzzxlSgGl37f9XUgQPVQVm1x5n3saVgZ-NTSscC6QbsGe3ZzWB4NcNA.gUyiwxvxoKW8Oq
Rv2rRCsg

Thanks

I figured it out nvm! the migration guide v4 talks about audience being used now in the auth init