Overview
When calling /oauth/token, a JSON Web Encryption (JWE) token is received when a JSON Web Token (JWT) is desired. This article explains the steps required to get a JWT.
Applies To
- Resource Servers
- APIs
- Access Tokens
Cause
Whether a JWE or a JWT when calling the token is returned is configured at the Resource Server/ API level. See Configure JSON Web Encryption for more information.
Solution
Check the audience being passed in the requests.
- See Get Access Tokens for more details.
Whichever API’s identifier is being used as the audience parameter would need to be changed to toggle off JWE as per the documentation here:
- See Configure JSON Web Encryption for more information
Please note that if no audience is provided, Auth0 will issue an opaque token instead, which is only intended for use with the tenant’s /userinfo endpoint as described in the following documentation