Token audience
A token audience identifies the recipient or recipients a security token is intended for.
Who should accept the token?
In a JSON Web Token, the aud claim identifies the intended recipient. The application carrying a token is not necessarily that recipient: a client obtains an access token to present to an API.
An OpenID Connect ID token must include the client application’s identifier in its audience. An API access token is intended for its resource. Even when both arrive during the same sign-in, they serve different recipients.
What the receiving service checks
The service checks the audience against the identifiers it accepts for that token type. A token for a calendar API should be rejected by an unrelated expenses API, even if its signature is valid and it has not expired. A genuine token can still be the wrong token for the request.
JWT audiences can be a single string or an array. RFC 7519 leaves the claim optional in the general JWT format; protocols such as OpenID Connect impose their own requirements. Follow the relevant token profile and provider documentation rather than assuming every JWT uses the same rules.
Audience validation is one check among several. The receiver also needs to validate the issuer, signature, lifetime, and other requirements for that token type, then decide whether the requested operation is authorized.