lcobucci/jwt · error · ConstraintViolation

The token is not allowed to be used by this audience

Error message

The token is not allowed to be used by this audience

What it means

Thrown by the PermittedFor constraint when the token's aud (audience) claim does not include the audience value configured in the constraint. It fires during assert() when Token::isPermittedFor() finds no match, meaning the token was issued for a different API/client than the one validating it.

Solutions

1. Configure the PermittedFor constraint with the exact audience identifier the token was issued for (the aud claim value set by the issuer)
2. If you are the issuer, make sure the aud claim is set when minting tokens for this consumer
3. Accept tokens intended for a different audience by registering a constraint with that audience value instead of the current one

When it happens

Trigger: Thrown at src/Validation/Constraint/PermittedFor.php:20 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of lcobucci/jwt@375813049c (2026-09-14). Data as JSON: /api/errors/d330d069e2945240. Report an issue: GitHub.

Appendix: source

Thrown at src/Validation/Constraint/PermittedFor.php:20

declare(strict_types=1);

namespace Lcobucci\JWT\Validation\Constraint;

use Lcobucci\JWT\Token;
use Lcobucci\JWT\Validation\Constraint;
use Lcobucci\JWT\Validation\ConstraintViolation;

final readonly class PermittedFor implements Constraint
{
    /** @param non-empty-string $audience */
    public function __construct(private string $audience)
    {
    }

    public function assert(Token $token): void
    {
        if (! $token->isPermittedFor($this->audience)) {
            throw ConstraintViolation::error(
                'The token is not allowed to be used by this audience',
                $this,
            );
        }
    }
}

View on GitHub (pinned to 375813049c)