JWT token is "invalid signature"?

Get Help
,
3

Hey again!

You’re on the right track!

My guess is that this token is missing the audience - If you do not specify an audience (aud claim) then the access token you get back will be opaque (not a jwt). That is, it cannot be decoded but can be used against the /userinfo endpoint. Some more on that here:

https://community.auth0.com/t/why-is-my-access-token-not-a-jwt-opaque-token/31028

And a helpful FAQ on audience in general:

https://community.auth0.com/t/what-is-the-audience/71414

Hope this helps!