JWT — invalid audience error when verifying a token

Fix JWT audience errors by aligning the aud claim with the expected value and the resource that verifies it.

intermediatedebuggingjwtauth

Symptoms

JsonWebTokenError: jwt audience invalid
The token works for one service but not another
Verification passes without checking audience
It fails after splitting services or renaming an API

Possible causes

The aud claim does not match the value the verifier expects
The token was issued for a different audience
A service was renamed or split and its expected audience changed
Verification omits audience so tokens valid elsewhere are rejected or accepted wrongly

Diagnosis steps

Read the aud claim

node -e "console.log(JSON.parse(Buffer.from(process.argv[1].split('.')[1], 'base64')))" <token>

Interpretation

The audience decoded from the token shows which service it was issued for.

Check the verifier expectation

grep -rn "audience\|aud" src | grep -i "verify\|jwt"

Interpretation

A mismatch between the configured expected audience and the token aud is the direct cause.

Align issuer configuration

grep -rn "audience" config/*.yaml

Interpretation

The issuer must mint tokens with the audience the verifier expects, so both sides need the same value.

Root cause

The token audience did not match the value the verifier required, because the token was issued for another audience or the expected audience changed without updating the issuer.

Fix

Issue tokens with the audience the verifier expects, keep issuer and verifier audience configuration in sync, and always validate audience so tokens minted for other services are rejected.

Verify the fix

Verify a freshly issued token for this service and confirm it is accepted, and confirm a token for another audience is still rejected.

Symptom walkthrough

Verification fails with an audience invalid error, often after services were split or an API was renamed. The aud claim names the intended recipient, so a token minted for service A is correctly rejected by service B. The failure is usually configuration drift between the issuer and the verifier rather than a signing problem, and checking audience is important because otherwise a token for one service could be replayed against another.

Fix in practice

Make the issuer mint tokens with the audience the verifier requires, keep that value in shared configuration, and validate audience on every verification so tokens intended for other services are rejected. Updating only one side produces exactly this mismatch.

Verification

Verify a freshly issued token for this service and confirm it is accepted, then confirm a token for a different audience is still rejected. Accepting the right token while rejecting the wrong one confirms the audience check works.

Diagnostic commands

Check the behavior with commands like these:

node -e "console.log(JSON.parse(Buffer.from(process.argv[1].split('.')[1], 'base64')))" <token>
grep -rn "audience\|aud" src | grep -i "verify\|jwt"
grep -rn "audience" config/*.yaml