# Requesting accessToken not returning a valid JWT

**URL:** <https://community.auth0.com/t/requesting-accesstoken-not-returning-a-valid-jwt/78958>\
**Category:** JWT.io\
**Tags:** jwt, access-token, auth0\
**Created:** [February 26, 2022, 2:15am UTC](https://community.auth0.com/t/requesting-accesstoken-not-returning-a-valid-jwt/78958 "2022-02-26T02:15:51Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![halsdunes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/halsdunes/32/35486_2.png) [@halsdunes](https://community.auth0.com/u/halsdunes)\
**Post date:** [February 26, 2022, 2:15am UTC](https://community.auth0.com/t/requesting-accesstoken-not-returning-a-valid-jwt/78958/1 "2022-02-26T02:15:51Z")

</div>

I have a NextJS app that uses the `@auth0/nextjs-auth0` as its authentication library. I’m trying to get an access token but the returned JWT is not a valid object according to [jwt.io](http://jwt.io).

For reference, this is my `.env.local` file:

```auto
AUTH0_SECRET='secret'
AUTH0_BASE_URL='http://localhost:3000'
AUTH0_ISSUER_BASE_URL='domain'
AUTH0_CLIENT_ID='client'
AUTH0_CLIENT_SECRET='clientsecret'
AUTH0_SCOPE='openid profile email'

```

And here is a super basic API route I have:

```plaintext
import { NextApiRequest, NextApiResponse } from "next";
import { getAccessToken } from "@auth0/nextjs-auth0";

export default async (req: NextApiRequest, res: NextApiResponse) => {
  const token = await getAccessToken(req, res, {
    scopes: ["openid", "profile", "email"],
  });

  res.status(200).json(token);
};

```

What am I doing wrong here?

---

<div class="post-metadata">

**Author:** ![markd](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/markd/32/38919_2.png) [@markd](https://community.auth0.com/u/markd)\
**Post date:** [February 26, 2022, 3:01pm UTC](https://community.auth0.com/t/requesting-accesstoken-not-returning-a-valid-jwt/78958/2 "2022-02-26T15:01:40Z")

</div>

Hello @halsdunes,

I looks like you are not including an `audience` string in your request. Without an `audience` string Auth0 will return an opaque access token which can be used only for querying the `userinfo` endpoint.

> **[Get Access Tokens](https://auth0.com/docs/secure/tokens/access-tokens/get-access-tokens#control-access-token-audience)**
>
> Learn how to request Access Tokens using the Authorize endpoint when authenticating users and include the target audience and scope of access requested by the app and granted by the user.

---

<div class="post-metadata">

**Author:** ![halsdunes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/halsdunes/32/35486_2.png) [@halsdunes](https://community.auth0.com/u/halsdunes)\
**Post date:** [February 26, 2022, 5:10pm UTC](https://community.auth0.com/t/requesting-accesstoken-not-returning-a-valid-jwt/78958/3 "2022-02-26T17:10:41Z")

</div>

Hi @markd,

I updated my `.env.local` like so:

```auto
AUTH0_SECRET='secret'
AUTH0_BASE_URL='http://localhost:3000'
AUTH0_ISSUER_BASE_URL='domain'
AUTH0_CLIENT_ID='client'
AUTH0_CLIENT_SECRET='clientsecret'
AUTH0_AUDIENCE='test'
AUTH0_SCOPE='openid profile email'

```

but now, when I attempt to log in, I get an error saying

```auto
access_denied (Service not found: test)

```

what should the `audience` value correspond to?

---

<div class="post-metadata">

**Author:** ![halsdunes](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/halsdunes/32/35486_2.png) [@halsdunes](https://community.auth0.com/u/halsdunes)\
**Post date:** [February 26, 2022, 6:12pm UTC](https://community.auth0.com/t/requesting-accesstoken-not-returning-a-valid-jwt/78958/4 "2022-02-26T18:12:57Z")

</div>

I was able to figure it out using [this previous answer](https://community.auth0.com/t/audience-your-api-identifier/35176/2)!

For anyone else that might be reading this, I went to the `API` section of the Auth0 dashboard and copied the `identifier` value as the `AUTH0_AUDIENCE` value in my `.env.local` file. You will need to restart the Next.js server and re-authenticate for the changes to work.

Thanks for setting me in the right direction @markd!

---

<div class="post-metadata">

**Author:** ![konrad.sopala](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/konrad.sopala/32/13516_2.png) [@konrad.sopala](https://community.auth0.com/u/konrad.sopala)\
**Post date:** [February 28, 2022, 10:25am UTC](https://community.auth0.com/t/requesting-accesstoken-not-returning-a-valid-jwt/78958/5 "2022-02-28T10:25:32Z")

</div>

Wooohoo perfect! Teamwork makes the dreamwork!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [March 15, 2022, 10:26am UTC](https://community.auth0.com/t/requesting-accesstoken-not-returning-a-valid-jwt/78958/6 "2022-03-15T10:26:10Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.