Understanding how the "audience" concept actually works

[ty.frith]

Relevant FAQs for future reference

What is the Audience?

Question: What is the Audience? Answer: The audience parameter exists as part of the OAuth2.0 protocol. You can read more information from the specification here. What is it? The audience (presented as the aud claim in the access token) defines the intended consumer of the token. This is typically the resource server (API, in the dashboard) that a client (Application) would like to access. It can be added to the request to authorize i.e. audience: 'https://test-api' Here is an example where …

How do I specify multiple audiences?

Question: How do I specify multiple audiences? Answer: This is not supported. If you have a microservice architecture or something similar, you should use scopes to distinguish between them in combination with a single audience. Video Tutorial [Managing Multiple Audiences Using a Logical API -- Auth0 Community Response Series]