# Audience Server

**URL:** <https://devforum.okta.com/t/audience-server/16075>\
**Category:** OAuth/OIDC\
**Tags:** api, spring, java\
**Created:** [September 11, 2021, 10:10am UTC](https://devforum.okta.com/t/audience-server/16075 "2021-09-11T10:10:17Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nelson.gomes](https://avatars.discourse-cdn.com/v4/letter/n/eb9ed0/32.png) [@nelson.gomes](https://devforum.okta.com/u/nelson.gomes)\
**Post date:** [September 11, 2021, 10:10am UTC](https://devforum.okta.com/t/audience-server/16075/1 "2021-09-11T10:10:17Z")

</div>

Sorry for the question  
But what is exactly a audience server or only audience  
Seems to be related with Authorizatiin Server  
Is some kind of log ?  
Or auditor server

I can access in admin console ?

Thanks  
Nelson Gomes

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [September 14, 2021, 4:24pm UTC](https://devforum.okta.com/t/audience-server/16075/2 "2021-09-14T16:24:38Z")

</div>

The audience is the resource/server that the access token is intended for. If you are working on an OAuth/authorization use case, you will need to validate the ‘aud’ claim in the token to ensure that the token that was received is intended to be used by the accessed resource.

More details about the Audience claim is in the JWT RFC: [rfc7519](https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3)

If you are using the Org Authorization server ([https://org.okta.com/oauth2/v1/authorize](https://org.okta.com/oauth2/v1/authorize), etc), the audience will be the client\_id. If you are using a Custom Authorization Server ([https://org.okta.com/oauth2/authorizationServerId/v1/authorize](https://org.okta.com/oauth2/authorizationServerId/v1/authorize), etc), you will [set this value yourself when you create the server](https://developer.okta.com/docs/guides/customize-authz-server/create-authz-server/) and it should be the absolute path for the protected resource, e.g. [https://api.example.com/pets](https://api.example.com/pets).

---

<div class="post-metadata">

**Author:** ![David.Klempfner](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/david.klempfner/32/4807_2.png) [@David.Klempfner](https://devforum.okta.com/u/David.Klempfner)\
**Post date:** [June 29, 2023, 3:31am UTC](https://devforum.okta.com/t/audience-server/16075/3 "2023-06-29T03:31:41Z")

</div>

I’m trying to create a custom authorization server, but still have no idea what to put in Audience.  
“absolute path for the protected resource” - what exactly is this? How can I find the value I’m meant to use?

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [July 6, 2023, 8:24pm UTC](https://devforum.okta.com/t/audience-server/16075/4 "2023-07-06T20:24:19Z")

</div>

There’s no right or wrong answer here. You are the one that will define the `audience` within Okta and then configure your resource server/API to expect this audience when it validates tokens. Naming the audience after the resource being protected is more or less a recommendation.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [February 13, 2024, 12:45am UTC](https://devforum.okta.com/t/audience-server/16075/5 "2024-02-13T00:45:31Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.