I have a .net core ASP MVC app that authenticates with Auth0 and properly returns an access token and id token. I would like to use the access token for authentication as described in the docs here. However, passing in an access token results in a 401 with "invalid audience".
1 Answer
This was tricky as the docs are woefully inadequate. In order to get the correct token for the API, you must get a token with the same audience at login (or otherwise). The end part of this example on github was key.
Events = new OpenIdConnectEvents
{
OnRedirectToIdentityProvider = context =>
{
// add any custom parameters here
context.ProtocolMessage.SetParameter("audience", "myapiaudience");
return Task.CompletedTask;
}
}