aud
What this is
aud may be a string or an array of strings. An access token minted for api://payments must not be accepted by api://admin. Always verify aud, even on internal services — stolen tokens get replayed across audiences.
FAQ
- ID token vs access token audience?
- OIDC ID tokens have aud = your client_id. Access tokens often have aud = the API. Mixing them up is a common 401.