Hi @lexakimov,
That header looks like an encrypted token, and you should only get these when you aren’t passing a valid audience.
Is the http://java-backend/ a valid API Identifier you have registered in Auth0?
1 Like