{"record":{"id":"d330d069e2945240","repo":"lcobucci/jwt","slug":"the-token-is-not-allowed-to-be-used-by-this-audience","errorCode":null,"errorMessage":"The token is not allowed to be used by this audience","messagePattern":"The token is not allowed to be used by this audience","errorType":"validation","errorClass":"ConstraintViolation","httpStatus":null,"severity":"error","filePath":"src/Validation/Constraint/PermittedFor.php","lineNumber":20,"sourceCode":"declare(strict_types=1);\n\nnamespace Lcobucci\\JWT\\Validation\\Constraint;\n\nuse Lcobucci\\JWT\\Token;\nuse Lcobucci\\JWT\\Validation\\Constraint;\nuse Lcobucci\\JWT\\Validation\\ConstraintViolation;\n\nfinal readonly class PermittedFor implements Constraint\n{\n    /** @param non-empty-string $audience */\n    public function __construct(private string $audience)\n    {\n    }\n\n    public function assert(Token $token): void\n    {\n        if (! $token->isPermittedFor($this->audience)) {\n            throw ConstraintViolation::error(\n                'The token is not allowed to be used by this audience',\n                $this,\n            );\n        }\n    }\n}\n","sourceCodeStart":2,"sourceCodeEnd":27,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Validation/Constraint/PermittedFor.php#L2-L27","documentation":"Thrown by the PermittedFor constraint when the token's aud (audience) claim does not include the audience value configured in the constraint. It fires during assert() when Token::isPermittedFor() finds no match, meaning the token was issued for a different API/client than the one validating it.","triggerScenarios":"Thrown at src/Validation/Constraint/PermittedFor.php:20 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure the PermittedFor constraint with the exact audience identifier the token was issued for (the aud claim value set by the issuer)","If you are the issuer, make sure the aud claim is set when minting tokens for this consumer","Accept tokens intended for a different audience by registering a constraint with that audience value instead of the current one"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}