{"record":{"id":"c2d7a9fb92b9de7a","repo":"crewAIInc/crewAI","slug":"invalid-token-audience","errorCode":null,"errorMessage":"Invalid token audience","messagePattern":"Invalid token audience","errorType":"http","errorClass":"HTTPException","httpStatus":401,"severity":"error","filePath":"lib/crewai/src/crewai/a2a/auth/server_schemes.py","lineNumber":315,"sourceCode":"                scheme=\"oidc\",\n                claims=claims,\n            )\n\n        except jwt.ExpiredSignatureError:\n            logger.debug(\n                \"OIDC authentication failed\",\n                extra={\"reason\": \"token_expired\", \"scheme\": \"oidc\"},\n            )\n            raise HTTPException(\n                status_code=HTTP_401_UNAUTHORIZED,\n                detail=\"Token has expired\",\n            ) from None\n        except jwt.InvalidAudienceError:\n            logger.debug(\n                \"OIDC authentication failed\",\n                extra={\"reason\": \"invalid_audience\", \"scheme\": \"oidc\"},\n            )\n            raise HTTPException(\n                status_code=HTTP_401_UNAUTHORIZED,\n                detail=\"Invalid token audience\",\n            ) from None\n        except jwt.InvalidIssuerError:\n            logger.debug(\n                \"OIDC authentication failed\",\n                extra={\"reason\": \"invalid_issuer\", \"scheme\": \"oidc\"},\n            )\n            raise HTTPException(\n                status_code=HTTP_401_UNAUTHORIZED,\n                detail=\"Invalid token issuer\",\n            ) from None\n        except jwt.MissingRequiredClaimError as e:\n            logger.debug(\n                \"OIDC authentication failed\",\n                extra={\"reason\": \"missing_claim\", \"claim\": e.claim, \"scheme\": \"oidc\"},\n            )\n            raise HTTPException(","sourceCodeStart":297,"sourceCodeEnd":333,"githubUrl":"https://github.com/crewAIInc/crewAI/blob/754d7323beb2fd042e33444a115ea2d5a47193f0/lib/crewai/src/crewai/a2a/auth/server_schemes.py#L297-L333","documentation":"Raised by OIDCAuth.authenticate() when jwt.decode() throws InvalidAudienceError: the JWT's `aud` claim does not match the `audience` configured on the scheme. This is the server refusing a token minted for a different API/client. It maps to HTTP 401 and logs reason='invalid_audience'.","triggerScenarios":"Scheme configured with audience='crewai-a2a' but the token was issued with aud='some-other-api'; audience configured as the OAuth2 client_id instead of the API identifier (common Auth0 mix-up); token issued for multiple audiences where none matches.","commonSituations":"Auth0 setups where developers put the client_id in audience instead of the API identifier; copying the audience from a different environment's provider config; reusing a token obtained for another downstream service.","solutions":["Check the token's aud claim (decode without verification: jwt.decode(tok, options={'verify_signature': False})['aud']) and align the scheme's `audience` with the value your IdP issues for this API.","In Auth0, use the API Identifier (e.g. https://myapi) as both the requested audience and the scheme's audience, not the client_id.","Ensure the client requests that audience during the token flow (audience parameter in the authorize/token request).","If the token legitimately has multiple audiences, pass audience as a list accepted by PyJWT."],"exampleFix":"# before\nauth = OIDCAuth(jwks_url=jwks, audience=\"abc123clientid\", ...)  # client_id used by mistake\n\n# after\nauth = OIDCAuth(jwks_url=jwks, audience=\"https://my-api.example.com\", ...)  # API identifier as issued in `aud`","handlingStrategy":"validation","validationCode":"import jwt\n\nclaims = jwt.decode(access_token, options={\"verify_signature\": False})\nassert claims.get(\"aud\") == configured_audience, (\n    f\"aud mismatch: token={claims.get('aud')!r} scheme={configured_audience!r}\"\n)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Request the correct `audience` in the token flow and mirror it in the scheme.","For Auth0, use the API identifier, not the client_id, as the audience.","Validate aud/iss/jwks_url together per environment at startup."],"tags":["a2a","oidc","jwt","audience","http-401"],"backgroundTag":null,"analyzedSha":"754d7323beb2fd042e33444a115ea2d5a47193f0","analyzedAt":"2026-08-15T04:06:56.746Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}