# JWT validation failed: audience 'api://wrong-service' does not match expected audience 'api://my-service'

- **ID:** `security/oauth2-jwt-audience-mismatch`
- **Domain:** security
- **Category:** auth_error
- **Error Code:** `JWT_AUDIENCE_MISMATCH`
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

The JWT's 'aud' (audience) claim does not match the audience configured for the resource server, often because the token was issued for a different API or the client requested the wrong audience.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Spring Security 6.3.0 | active | — | — |
| MSAL.js 2.0.0 | active | — | — |
| PyJWT 2.9.0 | active | — | — |
| Auth0 SPA SDK 2.0.0 | active | — | — |

## Workarounds

1. **Update the resource server configuration to expect the correct audience. For example, in Spring Boot, set `spring.security.oauth2.resourceserver.jwt.audiences=api://my-service`.** (90% success)
   ```
   Update the resource server configuration to expect the correct audience. For example, in Spring Boot, set `spring.security.oauth2.resourceserver.jwt.audiences=api://my-service`.
   ```
2. **Ensure the client application requests the correct audience when obtaining the token. For example, in an Angular app using MSAL, set `extraQueryParameters: {audience: 'api://my-service'}`.** (85% success)
   ```
   Ensure the client application requests the correct audience when obtaining the token. For example, in an Angular app using MSAL, set `extraQueryParameters: {audience: 'api://my-service'}`.
   ```
3. **If using Azure AD, verify the API's Application ID URI and ensure the client's API permissions are correctly configured to request that audience.** (80% success)
   ```
   If using Azure AD, verify the API's Application ID URI and ensure the client's API permissions are correctly configured to request that audience.
   ```

## Dead Ends

- **** — Changing the expected audience in the resource server to accept any audience is insecure, as it would allow tokens meant for other services to access the API. (90% fail)
- **** — Modifying the token's 'aud' claim client-side will fail signature validation, as the token is signed and any alteration invalidates the signature. (100% fail)
- **** — Clearing the browser cache and retrying does not fix the issue because the token is generated by the identity provider and the audience mismatch is a configuration problem. (30% fail)