github-starred/better-auth
2
0
Fork 0
mirror of https://github.com/better-auth/better-auth.git synced 2026-08-24 14:13:48 -05:00
Code Issues 2.5k Packages Projects Releases 112 Wiki Activity

OAuth2 provider: Should audience (aud) be client_id or API url? #2809

New Issue
Closed
opened 2026-03-13 10:21:33 -05:00 by GiteaMirror · 4 comments
GiteaMirror commented 2026-03-13 10:21:33 -05:00
Owner
Copy Link
Copy Source

Originally created by @lensbart on GitHub (Feb 2, 2026).

The documentation for valid audiences states that these are URLs. This is also what I find elsewhere online.

However the value of aud in the JWT payload is set to client_id when inspecting the id_token, and to the expected URLs in the access_token.

Is this an oversight? Shouldn‘t they both refer to URLs?

Originally created by @lensbart on GitHub (Feb 2, 2026). The documentation for [valid audiences](https://www.better-auth.com/docs/plugins/oauth-provider#valid-audiences) states that these are URLs. This is also what I find [elsewhere](https://sergiodxa.com/articles/oauth2-audience-explained) [online](https://stackoverflow.com/questions/28418360/jwt-json-web-token-audience-aud-versus-client-id-whats-the-difference). However the value of `aud` in the JWT payload is set to `client_id` when inspecting the `id_token`, and to the expected URLs in the `access_token`. Is this an oversight? Shouldn‘t they both refer to URLs?
GiteaMirror added the plugin label 2026-03-13 10:21:33 -05:00
GiteaMirror commented 2026-03-13 10:21:34 -05:00
Author
Owner
Copy Link
Copy Source

@better-auth-agent[bot] commented on GitHub (Feb 2, 2026):

The documentation indicates that the aud (audience) claim in the JWT payload is indeed set to the client_id, but best practices suggest that valid audiences should typically be URLs. This could lead to potential confusion regarding whether client_id or the API URL should be used as the audience.

Currently, there is an open question on whether this behavior is an oversight or aligns correctly with the intended configuration. You may consider bringing this up with the Better Auth development team for clarification, particularly in relation to the OAuth2 specification and audience definitions [1], [2].

If you're looking to troubleshoot this further, ensure that when you're implementing authorization flows, your audience aligns with the expected input for your specific application context. Is there a specific implementation you are currently working on that this is affecting?

If you need more help, tag @better-auth-agent in a comment so I can respond.

Diagram • Discord • GitHub

Diagram Join Star

@better-auth-agent[bot] commented on GitHub (Feb 2, 2026): The documentation indicates that the `aud` (audience) claim in the JWT payload is indeed set to the `client_id`, but best practices suggest that valid audiences should typically be URLs. This could lead to potential confusion regarding whether `client_id` or the API URL should be used as the audience. Currently, there is an open question on whether this behavior is an oversight or aligns correctly with the intended configuration. You may consider bringing this up with the Better Auth development team for clarification, particularly in relation to the OAuth2 specification and audience definitions [[1]](https://www.better-auth.com/docs/plugins/oauth-provider), [[2]](https://www.better-auth.com/docs/plugins/generic-oauth). If you're looking to troubleshoot this further, ensure that when you're implementing authorization flows, your audience aligns with the expected input for your specific application context. Is there a specific implementation you are currently working on that this is affecting? _If you need more help, tag @better-auth-agent in a comment so I can respond._ <!-- bot:webhook reply v1 --> [Diagram](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) • [Discord](https://discord.gg/better-auth) • [GitHub](https://github.com/better-auth/better-auth) [![Diagram](https://img.shields.io/badge/Diagram-2b3137?style=flat-square)](https://repodiagrams.s3.eu-north-1.amazonaws.com/better-auth_ultra_detailed_interactive.html) [![Join](https://img.shields.io/badge/join-5865F2?logo=discord&logoColor=white&style=flat-square)](https://discord.gg/better-auth) [![Star](https://img.shields.io/badge/star-181717?logo=github&logoColor=white&style=flat-square)](https://github.com/better-auth/better-auth)
GiteaMirror commented 2026-03-13 10:21:34 -05:00
Author
Owner
Copy Link
Copy Source

@bytaesu commented on GitHub (Feb 2, 2026):

Note

Audience(s) that this ID Token is intended for. It MUST contain the OAuth 2.0 client_id of the Relying Party as an audience value. It MAY also contain identifiers for other audiences. In the general case, the aud value is an array of case-sensitive strings. In the common special case when there is one audience, the aud value MAY be a single case-sensitive string.
https://openid.net/specs/openid-connect-core-1_0.html

Hi @lensbart, they’re meant to be sent to different targets

  • ID Token's aud = client_id → for Client App to verify
  • Access Token's aud = resource URL → for API Server to verify
@bytaesu commented on GitHub (Feb 2, 2026): > [!NOTE] > Audience(s) that this ID Token is intended for. It MUST contain the OAuth 2.0 `client_id` of the Relying Party as an audience value. It MAY also contain identifiers for other audiences. In the general case, the aud value is an array of case-sensitive strings. In the common special case when there is one audience, the aud value MAY be a single case-sensitive string. > https://openid.net/specs/openid-connect-core-1_0.html Hi @lensbart, they’re meant to be sent to different targets - ID Token's `aud` = `client_id` → for Client App to verify - Access Token's `aud` = resource URL → for API Server to verify
GiteaMirror commented 2026-03-13 10:21:34 -05:00
Author
Owner
Copy Link
Copy Source

@bytaesu commented on GitHub (Feb 3, 2026):

Alright, I'm closing this 🙂
Feel free to mention me if you have further questions!

@bytaesu commented on GitHub (Feb 3, 2026): Alright, I'm closing this 🙂 Feel free to mention me if you have further questions!
GiteaMirror commented 2026-03-13 10:21:35 -05:00
Author
Owner
Copy Link
Copy Source

@lensbart commented on GitHub (Feb 3, 2026):

Thanks for the quick response! That clears things up. 🙂

@lensbart commented on GitHub (Feb 3, 2026): Thanks for the quick response! That clears things up. 🙂
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
adapter
astro
awaiting external contributor
blocked
breaking
breaking change
bug
c-devops
core
credentials
database
dependencies
devops
devtools
docs
documentation
duplicate
elysia
enhancement
enterprise
expo
express
fastify
good first issue
help wanted
hono
identity
infra
integration
invalid
javascript
locked
maintenance
need-more-information
needs: info
needs: repro
nextjs
nuxt
oauth
organization
P0
payments
perf
platform
plugin
pull-request
Mirrored from GitHub Pull Request
 question
ready
regression
remix
security
social-provider
solid
stale
svelte
tanstack-start
tracking
version-bump
vue
wontfix
No labels plugin
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
GiteaMirror ninjasurge (Kaehlen Rog)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/better-auth#2809