dgraph-io/dgraph · error

audience value was expected but not provided

Error message

audience value was expected but not provided

What it means

`validateAudience` verifies the JWT's `aud` claim against the Audience list configured in Dgraph.Authorization. If the token contains an `aud` claim but the server configuration has no Audience values (authMeta.Audience is nil), validation cannot succeed and this error is returned.

Source

Thrown at graphql/authorization/auth.go:290

	// and other claims present in the token.
	for k, v := range c.AuthVariables {
		result[k] = v
	}

	// update `AuthVariables` with `result` map
	c.AuthVariables = result
	return nil
}

func (c *CustomClaims) validateAudience() error {
	// If there's no audience claim, ignore
	if len(c.Audience) == 0 {
		return nil
	}

	// If there is an audience claim, but no value provided, fail
	if c.authMeta.Audience == nil {
		return fmt.Errorf("audience value was expected but not provided")
	}

	var match = false
	for _, audStr := range c.Audience {
		for _, expectedAudStr := range c.authMeta.Audience {
			if subtle.ConstantTimeCompare([]byte(audStr), []byte(expectedAudStr)) == 1 {
				match = true
				break
			}
		}
	}
	if !match {
		return fmt.Errorf("JWT `aud` value doesn't match with the audience")
	}
	return nil
}

func (a *AuthMeta) ExtractCustomClaims(ctx context.Context) (*CustomClaims, error) {

View on GitHub (pinned to 759e242be6)

Solutions

1. Add the expected audience value(s) to the `Audience` array in the Dgraph.Authorization header so it matches the token's `aud` claim
2. Check the token's `aud` (e.g. jwt.io) and copy that exact string into the config
3. Restart Dgraph after updating the authorization header

Example fix

// before
Dgraph.Authorization: {"JWKUrl":"https://idp/jwks.json","Namespace":"https://dgraph.io/jwt/claims","Algo":"RS256"}
// after
Dgraph.Authorization: {"JWKUrl":"https://idp/jwks.json","Namespace":"https://dgraph.io/jwt/claims","Audience":["my-api-audience"],"Algo":"RS256"}

const payload = JSON.parse(atob(jwt.split('.')[1]));
if (payload.aud && !(config.Audience?.length)) {
  throw new Error('Token has aud claim but Dgraph.Authorization Audience is empty');
}

When it happens

Trigger: A request whose JWT includes an audience claim while the Dgraph.Authorization header was parsed with an empty/absent Audience array — e.g. the IDP always sets `aud` but the Dgraph config omitted `"Audience":["..."]`.

Common situations: Deploying Dgraph against an IDP that mandatorily issues `aud` while the config was written for a token without one; Audience accidentally left as an empty array; switching IDPs whose tokens always carry aud.

Related errors

• expecting either JWKUrl or JWKUrls, both were given
• expecting either JWKUrl/JWKUrls or (VerificationKey, Algo),
• required field missing in Dgraph.Authorization:%s
• JWT `aud` value doesn't match with the audience
• jwt token cannot be validated because verification algorithm

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/2030fb8766448690. Report an issue: GitHub.