Implement multiple audiences in an access token

Hey @j.krabs thanks for following up on this :slight_smile:

I unfortunately have no update regarding this being added as a feature - I’ll add some general context to the idea:

Supporting multiple audiences is a generally viewed as not a great idea - It dilutes the value of having audiences to begin with (makes every call more dangerous and increases the blast radius in case of token leak), introduces ambiguity (to what audience does a particular scope refers to?) and is very challenging in terms of authorization policies (different audiences requiring different auth factors, different max_age values, etc.).

If multiple APIs are part of the same logical API, then using a single logical API is the current recommended approach:

1 Like