# JWT token is "invalid signature"?

**URL:** <https://community.auth0.com/t/jwt-token-is-invalid-signature/105796>\
**Category:** Get Help\
**Tags:** login-experience, new-universal-login-experience\
**Created:** [April 29, 2023, 10:40am UTC](https://community.auth0.com/t/jwt-token-is-invalid-signature/105796 "2023-04-29T10:40:57Z")\
**Posts on this page:** 1\
**Showing post:** 6

<div class="post-metadata">

**Author:** ![peter.fernandez](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/peter.fernandez/32/45477_2.png) [@peter.fernandez](https://community.auth0.com/u/peter.fernandez)\
**Post date:** [May 3, 2023, 8:12am UTC](https://community.auth0.com/t/jwt-token-is-invalid-signature/105796/6 "2023-05-03T08:12:36Z")

</div>

> [@ty.frith](#):
>
> My guess is that this token is missing the `audience` - If you do not specify an `audience` (`aud` claim) then the access token you get back will be opaque (not a jwt). That is, it cannot be decoded but _can_ be used against the /userinfo endpoint. Some more on that here:

@ty.frith is spot on; that’s exactly what’s happening 🙂

Auth0 typically generates both an _ID Token_ and an _Access Token_: the _ID Token_ being designed for use by an application in order to build the application level session; the _Access Token_ being designed for use by your own API. Without the OAuth 2 `audience` parameter, the _(Access) Token_ returned is designed only for use with the Auth0 `/userinfo` endpoint ([here](https://auth0.com/docs/api/authentication#get-user-info)). Whilst it is a JWT, it uses an alternate encoding algorithm so is effectively opaque, and not designed to be decoded by [jwt.io](http://jwt.io).

Typically, any _Access Token_ you pass to your own API should have been generated by defining a (custom) API in Auth0 - see [here](https://auth0.com/docs/get-started/apis) for more details. You will typically specify a custom _audience_ (a.k.a. `Identifier`) for your API and also typically define `scopes`; both of which your API will typically validate. The _Access Tokens_ generated for the (custom) `audience` can then be used to call your API securely **and** your API can also use it to call the Auth0 `/userinfo` endpoint too: all (custom) API tokens generated in Auth0 typically support two intended audiences, the custom one you define _and_ also the Auth0 `/userinfo` endpoint.

Hope that helps 🕶

---

_[View the full topic](https://community.auth0.com/t/jwt-token-is-invalid-signature/105796)._