Issuer difference between access token and session token

Help
,
1

Hi, I have a question regarding the content of the “iss” field on access tokens.

In practice, it appears to be https://{{tenant}}.{{region}}.auth0.com when the access token is obtained via the Auth0 login process.

I recently experimented with the post login actions, and generated a token to pass information securely to an application, following this post: Login Flow

const token = api.redirect.encodeToken({
    secret: event.secrets.MY_SHARED_SECRET,
    payload: {
      email: event.user.email,
    },
  });

It appears that token created contains an issuer which is not an absolute URI but the domain name: {{tenant}}.auth0.com instead of https://{{tenant}}.{{region}}.auth0.com

Is that an expected behaviour ? why is the issuer different ?

1 Like