# JWT token is "invalid signature"?

**URL:** <https://community.auth0.com/t/jwt-token-is-invalid-signature/105796>\
**Category:** Get Help\
**Tags:** new-universal-login-experience, login-experience\
**Created:** [April 29, 2023, 10:40am UTC](https://community.auth0.com/t/jwt-token-is-invalid-signature/105796 "2023-04-29T10:40:57Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [May 2, 2023, 8:58pm UTC](https://community.auth0.com/t/jwt-token-is-invalid-signature/105796/5 "2023-05-02T20:58:01Z")

</div>

Hey @kkrp1 !

> [@kkrp1](#):
>
> I’m mightily confused. I don’t have a hand in generating that token - it’s the result of resolving the query string params sent to my callback URL. I thought that what I resolved it to (via `getTokenSilently()`) generated a JWT. But you’re saying it’s lacking something, so how do I stop it lacking that thing?

Again, this all comes down to the `audience` - This would be passed to `getTokenSilently` via [authorizationParams](https://auth0.github.io/auth0-spa-js/interfaces/GetTokenSilentlyOptions.html#authorizationParams).

> [@kkrp1](#):
>
> [This page](https://auth0.com/docs/secure/tokens/access-tokens) suggests that, in my situation, what I’m actually generating is not a JWT but an “opaque access token”. Accordingly, this doesn’t need validating, merely authenticating against the `/userinfo` endpoint. So if I understand that article correctly, authentication for my case _is_ as simple as just calling that endpoint. If I get a profile, the user is auth’d; if I don’t, they’re not. But you mentioned above that wasn’t ideal, so I’m confused.

If the _only_ thing you are doing is using the access token to call `/userinfo` then you are correct in that you do not need an audience, nor do you need to validate the token per se. In most cases, the access token is used to access an API (your API) and in that case you’d want a JWT to inspect which does require an `audience` (your API identifier in Auth0) as you’ve seen.

---

_[View the full topic](https://community.auth0.com/t/jwt-token-is-invalid-signature/105796)._