JWT token is "invalid signature"?

[tyf]

Hey @kkrp1 !

@kkrp1

I’m mightily confused. I don’t have a hand in generating that token - it’s the result of resolving the query string params sent to my callback URL. I thought that what I resolved it to (via getTokenSilently()) generated a JWT. But you’re saying it’s lacking something, so how do I stop it lacking that thing?

Again, this all comes down to the audience - This would be passed to getTokenSilently via authorizationParams.

@kkrp1

This page suggests that, in my situation, what I’m actually generating is not a JWT but an “opaque access token”. Accordingly, this doesn’t need validating, merely authenticating against the /userinfo endpoint. So if I understand that article correctly, authentication for my case is as simple as just calling that endpoint. If I get a profile, the user is auth’d; if I don’t, they’re not. But you mentioned above that wasn’t ideal, so I’m confused.

If the only thing you are doing is using the access token to call /userinfo then you are correct in that you do not need an audience, nor do you need to validate the token per se. In most cases, the access token is used to access an API (your API) and in that case you’d want a JWT to inspect which does require an audience (your API identifier in Auth0) as you’ve seen.