# WebAuth checkSession() returns a token that is NOT an AccessToken

**URL:** <https://community.auth0.com/t/webauth-checksession-returns-a-token-that-is-not-an-accesstoken/21195>\
**Category:** Get Help\
**Created:** [February 11, 2019, 9:42pm UTC](https://community.auth0.com/t/webauth-checksession-returns-a-token-that-is-not-an-accesstoken/21195 "2019-02-11T21:42:49Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dapug](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dapug/32/9219_2.png) [@dapug](https://community.auth0.com/u/dapug)\
**Post date:** [February 11, 2019, 9:42pm UTC](https://community.auth0.com/t/webauth-checksession-returns-a-token-that-is-not-an-accesstoken/21195/1 "2019-02-11T21:42:50Z")

</div>

I have a SPA app that calls to an API requiring an access token, all set up and working great.

When I sign in using WebAuth (passwordlessLogin), I get an AccessToken as expected (very long string “eyJ0eXAiO…” - probably 400 chars long, huge. API calls with this JWT token work great.

Then later I call checkSession() to “renew” the token. This method succeeds, no error. I clearly get a response back with both authResult. **accessToken** and authResult. **idToken**. HOWEVER, what I get this time is NOT an access token! It is a short token (like maybe 30-50 chars), not JWT and cannot be used for calls to the API.

Why? What is this non-JWT token being returned as an accessToken property of the response?

Nothing in the docs explains this.

---

<div class="post-metadata">

**Author:** ![john.gateley](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/john.gateley/32/10879_2.png) [@john.gateley](https://community.auth0.com/u/john.gateley)\
**Post date:** [February 12, 2019, 3:46pm UTC](https://community.auth0.com/t/webauth-checksession-returns-a-token-that-is-not-an-accesstoken/21195/2 "2019-02-12T15:46:40Z")

</div>

Make sure you are specifying an audience for checkSession.

John

---

<div class="post-metadata">

**Author:** ![dapug](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dapug/32/9219_2.png) [@dapug](https://community.auth0.com/u/dapug)\
**Post date:** [February 13, 2019, 4:27pm UTC](https://community.auth0.com/t/webauth-checksession-returns-a-token-that-is-not-an-accesstoken/21195/3 "2019-02-13T16:27:36Z")

</div>

Thank you. Yes, I am using the exact same config (and instance for that matter) for both the initial call, and then the checkSession() call. As mentioned, sign-in (passwordlessLogin) works great, accessToken I get is a valid JWT. But then on checkSession, the accessToken is NOT a JWT, same exact params in WebAuth here!

```
    auth0 = new auth0.WebAuth({
        domain: AUTH_CONFIG.auth0domain,
        clientID: AUTH_CONFIG.auth0clientId,
        redirectUri: AUTH_CONFIG.auth0CallbackUrl,
        responseType: 'token id_token',
        audience: 'http://localhost:50032',
        scope: 'openid profile read:api'
    })

```

I just don’t see what I’m doing wrong. Serious head scratcher, and app show stopper.

---

<div class="post-metadata">

**Author:** ![dapug](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/dapug/32/9219_2.png) [@dapug](https://community.auth0.com/u/dapug)\
**Post date:** [February 20, 2019, 8:43pm UTC](https://community.auth0.com/t/webauth-checksession-returns-a-token-that-is-not-an-accesstoken/21195/4 "2019-02-20T20:43:53Z")

</div>

@john.gateley should I open a support ticket? I’m really not seeing how this is an error on my part, and at the very least, it might be good to be aware that docs are severely lacking if there are multiple token types returned on .accessToken (not just JWT).

---

<div class="post-metadata">

**Author:** ![nicolas\_sabena](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/nicolas_sabena/32/6064_2.png) [@nicolas\_sabena](https://community.auth0.com/u/nicolas_sabena)\
**Post date:** [February 21, 2019, 5:55pm UTC](https://community.auth0.com/t/webauth-checksession-returns-a-token-that-is-not-an-accesstoken/21195/6 "2019-02-21T17:55:53Z")

</div>

Hi @dapug.

Can you share a [.HAR file](https://auth0.com/docs/har) that shows the `checkSession` request via DM? That might help explain what’s going on here.

As for the token formats, Auth0 will issue opaque access tokens when they target an internal Auth0 endpoint (like the OIDC `/userinfo` endpoint), and JWT tokens when the audience is a custom API (and that’s why the .HAR file will help to check if the `audience` is being provided in the token request).  
I’ll see that the access token formats are made clear in the documentation.

---

<div class="post-metadata">

**Author:** ![James.Morrison](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/james.morrison/32/13507_2.png) [@James.Morrison](https://community.auth0.com/u/James.Morrison)\
**Post date:** [March 7, 2019, 9:55pm UTC](https://community.auth0.com/t/webauth-checksession-returns-a-token-that-is-not-an-accesstoken/21195/7 "2019-03-07T21:55:56Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.