Audience Server

The audience is the resource/server that the access token is intended for. If you are working on an OAuth/authorization use case, you will need to validate the ‘aud’ claim in the token to ensure that the token that was received is intended to be used by the accessed resource.

More details about the Audience claim is in the JWT RFC: rfc7519

If you are using the Org Authorization server (https://org.okta.com/oauth2/v1/authorize, etc), the audience will be the client_id. If you are using a Custom Authorization Server (https://org.okta.com/oauth2/authorizationServerId/v1/authorize, etc), you will set this value yourself when you create the server and it should be the absolute path for the protected resource, e.g. https://api.example.com/pets.