crewAIInc/crewAI · error · Exception

Invalid token audience. Got: '{actual_audience}'. Expected:

Error message

Invalid token audience. Got: '{actual_audience}'. Expected: '{audience}'

What it means

Error "Invalid token audience. Got: '{actual_audience}'. Expected: '{audience}'" thrown in crewAIInc/crewAI.

Source

Thrown at lib/crewai-core/src/crewai_core/auth/utils.py:58

            signing_key.key,
            algorithms=ALGORITHMS,
            audience=audience,
            issuer=issuer,
            leeway=10.0,
            options={
                "verify_signature": True,
                "verify_exp": True,
                "verify_nbf": True,
                "verify_iat": True,
                "require": ["exp", "iat", "iss", "aud", "sub"],
            },
        )

    except jwt.ExpiredSignatureError as e:
        raise Exception("Token has expired.") from e
    except jwt.InvalidAudienceError as e:
        actual_audience = _unverified_decoded_token.get("aud", "[no audience found]")
        raise Exception(
            f"Invalid token audience. Got: '{actual_audience}'. Expected: '{audience}'"
        ) from e
    except jwt.InvalidIssuerError as e:
        actual_issuer = _unverified_decoded_token.get("iss", "[no issuer found]")
        raise Exception(
            f"Invalid token issuer. Got: '{actual_issuer}'. Expected: '{issuer}'"
        ) from e
    except jwt.MissingRequiredClaimError as e:
        raise Exception(f"Token is missing required claims: {e!s}") from e
    except jwt.exceptions.PyJWKClientError as e:
        raise Exception(f"JWKS or key processing error: {e!s}") from e
    except jwt.InvalidTokenError as e:
        raise Exception(f"Invalid token: {e!s}") from e

View on GitHub (pinned to 754d7323be)

Solutions

1. Verify the token was issued for this API's audience.
2. Check the configured audience matches the 'aud' claim in the token.

When it happens

Trigger: Thrown at lib/crewai-core/src/crewai_core/auth/utils.py:58 when the library encounters an invalid state.

Common situations: Occurs when the token's audience claim does not match the configured audience. Verify the token was issued for the expected audience value.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of crewAIInc/crewAI@754d7323be (2026-08-15). Data as JSON: /api/errors/da43715ddf28fd6f. Report an issue: GitHub.