Yes, the audience for an id_token
will be the Client ID for the Client to which the id_token
was issued.
The audience for your access_token
will be for the API Identifier (“http://XXX.YYY.com/api”). You should be sending the access_token
to authenticate requests to your API Server
Please see the following docs understand the difference between and usage of the two:
Also, see this section of the Angular Quickstart:
https://auth0.com/docs/quickstart/spa/angular2/03-calling-an-api