{"record":{"id":"cab1ac1bb930e539","repo":"instructure/canvas-lms","slug":"invalid-aud","errorCode":null,"errorMessage":"invalid aud","messagePattern":"invalid aud","errorType":"validation","errorClass":"InvalidTokenError","httpStatus":401,"severity":"error","filePath":"lib/lti/oauth2/access_token.rb","lineNumber":54,"sourceCode":"      rescue Canvas::Security::TokenExpired => e\n        raise InvalidTokenError, \"token has expired\", e.backtrace\n      rescue => e\n        raise InvalidTokenError, e\n      end\n\n      def initialize(aud:, sub:, jwt: nil, reg_key: nil, shard_id: nil)\n        @_jwt = jwt if jwt\n        @reg_key = reg_key || (jwt && decoded_jwt[\"reg_key\"])\n        @aud = aud\n        @sub = sub\n        @shard_id = shard_id\n      end\n\n      def validate!\n        decoded_jwt = Canvas::Security.decode_jwt(jwt)\n        check_required_assertions(decoded_jwt.keys)\n        raise InvalidTokenError, \"invalid iss\" if decoded_jwt[\"iss\"] != ISS\n        raise InvalidTokenError, \"invalid aud\" unless [*decoded_jwt[:aud]].include?(aud)\n        raise InvalidTokenError, \"iat must be in the past\" unless Time.zone.at(decoded_jwt[\"iat\"]) < Time.zone.now\n\n        true\n      rescue InvalidTokenError\n        raise\n      rescue Canvas::Security::TokenExpired => e\n        raise InvalidTokenError, \"token has expired\", e.backtrace\n      rescue => e\n        raise InvalidTokenError, e\n      end\n\n      def to_s\n        jwt\n      end\n\n      private\n\n      def decoded_jwt","sourceCodeStart":36,"sourceCodeEnd":72,"githubUrl":"https://github.com/instructure/canvas-lms/blob/1c9f0bb8013ed69c4f2efe11fd483025469b7e6c/lib/lti/oauth2/access_token.rb#L36-L72","documentation":"Lti::OAuth2::AccessToken#validate! verifies that the JWT's aud claim (treated as a list) includes the aud value the token was constructed/parsed with. If the audience does not match, InvalidTokenError 'invalid aud' is raised, preventing tokens minted for one audience from being replayed against another.","triggerScenarios":"Calling validate! with an aud argument that differs from the aud claim embedded in the JWT - e.g. using the token against a different service endpoint URL than the one it was issued for.","commonSituations":"Reusing a token across Canvas shards/accounts with different audience URLs, environment mismatches (test vs production Canvas domains), or the tool passing the wrong redirect/service URL as aud.","solutions":["Pass the same audience URL to validate! that was used when the JWT was created","Regenerate the token with the correct target audience via create_jwt","Confirm you are not mixing Canvas environments/shards whose aud URLs differ"],"exampleFix":"# before\ntoken = Lti::OAuth2::AccessToken.create_jwt(aud: 'https://other.canvas.test/api', sub: sub)\nLti::OAuth2::AccessToken.from_jwt(aud: 'https://canvas.prod/api', jwt: token.to_s).validate!\n# after\ntoken = Lti::OAuth2::AccessToken.create_jwt(aud: 'https://canvas.prod/api', sub: sub)\nLti::OAuth2::AccessToken.from_jwt(aud: 'https://canvas.prod/api', jwt: token.to_s).validate!","handlingStrategy":"validation","validationCode":"aud_claim = JSON.parse(Base64.urlsafe_decode64(jwt.split('.')[1]))['aud']\nArray(aud_claim).include?(expected_aud) or raise 'aud mismatch'","typeGuard":null,"tryCatchPattern":"begin\n  token.validate!\nrescue Lti::OAuth2::AccessToken::InvalidTokenError => e\n  raise unless e.message == 'invalid aud'\n  token = Lti::OAuth2::AccessToken.create_jwt(aud: target_aud, sub: sub)\n  token.validate!\nend","preventionTips":["Pass the identical aud to create_jwt/from_jwt and validate!","Avoid sharing tokens across Canvas environments, shards, or accounts","Derive aud from the target service URL rather than hardcoding it"],"tags":["lti","oauth2","jwt","audience"],"backgroundTag":"invalid-argument-value","analyzedSha":"1c9f0bb8013ed69c4f2efe11fd483025469b7e6c","analyzedAt":"2026-09-15T20:33:18.891Z","contentChangedAt":"2026-09-15T20:33:18.891Z","schemaVersion":2},"datasetVersion":"2026-09-23T02:17:17.105Z"}