# Difference between aud in custom authrization server and ClientId

**URL:** <https://devforum.okta.com/t/difference-between-aud-in-custom-authrization-server-and-clientid/8351>\
**Category:** Questions\
**Created:** [March 4, 2020, 9:28pm UTC](https://devforum.okta.com/t/difference-between-aud-in-custom-authrization-server-and-clientid/8351 "2020-03-04T21:28:12Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jelbatnigi](https://avatars.discourse-cdn.com/v4/letter/j/ecae2f/32.png) [@jelbatnigi](https://devforum.okta.com/u/jelbatnigi)\
**Post date:** [March 4, 2020, 9:28pm UTC](https://devforum.okta.com/t/difference-between-aud-in-custom-authrization-server-and-clientid/8351/1 "2020-03-04T21:28:12Z")

</div>

I have a SPA client that authenticates and gets back a token with aud equals to the client ID. Now if I want to use this token to validate against my authorization server it will fail because the authorization server has a different aud.  
in the OKTA documentation it states that Audience in the authorization server should equals to the API url. so If I try to authenticate using the authorization server I still get the client Id as aud and not what I specified in the auth server.

Can someone explain the difference here?

---

<div class="post-metadata">

**Author:** ![Govner](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/govner/32/1099_2.png) [@Govner](https://devforum.okta.com/u/Govner)\
**Post date:** [March 4, 2020, 9:46pm UTC](https://devforum.okta.com/t/difference-between-aud-in-custom-authrization-server-and-clientid/8351/2 "2020-03-04T21:46:49Z")

</div>

That should be the case for an id token: [https://developer.okta.com/docs/guides/validate-id-tokens/overview/#verify-the-claims](https://developer.okta.com/docs/guides/validate-id-tokens/overview/#verify-the-claims) but the access token should have the audience specific to the downstream API (resource server): [https://developer.okta.com/docs/guides/validate-access-tokens/overview/#verify-the-claims](https://developer.okta.com/docs/guides/validate-access-tokens/overview/#verify-the-claims)

---

<div class="post-metadata">

**Author:** ![jelbatnigi](https://avatars.discourse-cdn.com/v4/letter/j/ecae2f/32.png) [@jelbatnigi](https://devforum.okta.com/u/jelbatnigi)\
**Post date:** [March 6, 2020, 9:30pm UTC](https://devforum.okta.com/t/difference-between-aud-in-custom-authrization-server-and-clientid/8351/3 "2020-03-06T21:30:20Z")

</div>

Ok Thanks that works. now I am able to get the proper aud in the access token. One thing though…  
In my angular app I am trying to get the identity claims using  
oauthService.getIdentityClaims()  
The claims that I get are from the id token. How can I get the identity claims from the access token instead?

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 23, 2024, 10:48pm UTC](https://devforum.okta.com/t/difference-between-aud-in-custom-authrization-server-and-clientid/8351/4 "2024-01-23T22:48:30Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.