# Invalid access\_token

**URL:** <https://community.auth0.com/t/invalid-access-token/39304>\
**Category:** JWT.io\
**Tags:** jwt, auth0\
**Created:** [March 12, 2020, 10:09pm UTC](https://community.auth0.com/t/invalid-access-token/39304 "2020-03-12T22:09:44Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sylvaingirard](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sylvaingirard/32/13822_2.png) [@sylvaingirard](https://community.auth0.com/u/sylvaingirard)\
**Post date:** [March 12, 2020, 10:09pm UTC](https://community.auth0.com/t/invalid-access-token/39304/1 "2020-03-12T22:09:44Z")

</div>

Hi,

Since a couple of days I’m getting invalid access\_tokens. It’s in this form 41-NESMPfNb39I7xbG0JyXiB6yDM-1Yw and I don’t seem to have changed anything that might have caused this. The that initiates authentication is an Angular SPA using code grant with the angular-auth-oidc-client package for authentication. I’m not getting any errors and the id\_token looks fine.

---

<div class="post-metadata">

**Author:** ![jatinvaidya](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/jatinvaidya/32/13907_2.png) [@jatinvaidya](https://community.auth0.com/u/jatinvaidya)\
**Post date:** [March 12, 2020, 11:57pm UTC](https://community.auth0.com/t/invalid-access-token/39304/2 "2020-03-12T23:57:05Z")

</div>

Hi @sylvaingirard,

Welcome to the community!  
Do you mean to say that earlier you received JWT format access\_tokens in your app, and recently started receiving opaque access\_tokens?

Also, what makes you say those access\_tokens are “invalid” (especially since you are not getting any errors)? Auth0 Authorization Server returns a JWT format `access_token` only when you specify an `audience=my-custom-api-identifier` parameter in your authorization request. Otherwise an opaque `access_token` is returned which is only good for use on your tenant’s `/userinfo` endpoint.

---

<div class="post-metadata">

**Author:** ![sylvaingirard](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/sylvaingirard/32/13822_2.png) [@sylvaingirard](https://community.auth0.com/u/sylvaingirard)\
**Post date:** [March 13, 2020, 7:26am UTC](https://community.auth0.com/t/invalid-access-token/39304/3 "2020-03-13T07:26:41Z")

</div>

Hi,

Sorry for being a bit unclear. I actually meant that it’s not a valid JWT token. Adding the audience to the token request seems to be going wrong indeed, which was also the case some time ago.

Thanks for the pointer.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 28, 2020, 7:26am UTC](https://community.auth0.com/t/invalid-access-token/39304/4 "2020-03-28T07:26:43Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.