# Validate Okta Audience

**URL:** <https://devforum.okta.com/t/validate-okta-audience/8052>\
**Category:** Questions\
**Created:** [February 11, 2020, 7:15pm UTC](https://devforum.okta.com/t/validate-okta-audience/8052 "2020-02-11T19:15:42Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![afms](https://avatars.discourse-cdn.com/v4/letter/a/b487fb/32.png) [@afms](https://devforum.okta.com/u/afms)\
**Post date:** [February 11, 2020, 7:15pm UTC](https://devforum.okta.com/t/validate-okta-audience/8052/1 "2020-02-11T19:15:42Z")

</div>

Hi,

I’m working in a project that contains 2 different apps (iOS Native App, DotNetCore Web App) and a middleware (also in dotnet).  
Both apps need to login using Okta SDK and then call some endpoints in the middleware, that should take the access token and validate it also using the Okta SDK.

The problem is that i get different audiences from both apps…  
in the iOS app i get `api://default` but in the web app i get the ClientId and i can’t find a way to make both work.

What can i do to fix this? is it possible to override **DefaultTokenValidationParameters** in the SDK to disable Audience Validation?

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 11, 2020, 7:36pm UTC](https://devforum.okta.com/t/validate-okta-audience/8052/2 "2020-02-11T19:36:12Z")

</div>

First thing to note is that you’re going to want to update it so that the middleware and the web/native applications are using the same Authorization Server.

The fact that you see the Client ID as the ‘aud’ for your Web App makes me think that you are trying to validate an ID token (unless you made a custom Authorization Server where you set the audience to the client ID yourself, of course), as [the ‘aud’ in an ID token will always be the OAuth/OIDC client ID](https://developer.okta.com/docs/reference/api/oidc/#base-claims-always-present).

Can you ensure that you are only trying to validate access tokens? It sounds like your iOS application is looking at an access token issued by the ‘default’ authorization server, so you just want to make sure your .NET web app is as well.

---

<div class="post-metadata">

**Author:** ![afms](https://avatars.discourse-cdn.com/v4/letter/a/b487fb/32.png) [@afms](https://devforum.okta.com/u/afms)\
**Post date:** [February 11, 2020, 8:35pm UTC](https://devforum.okta.com/t/validate-okta-audience/8052/3 "2020-02-11T20:35:50Z")

</div>

Thank you!!  
i didn’t notice that i was using **id\_token** instead of **access\_token** 😅

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [February 11, 2020, 8:38pm UTC](https://devforum.okta.com/t/validate-okta-audience/8052/4 "2020-02-11T20:38:34Z")

</div>

No problem! Good luck with your project!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 23, 2024, 8:31pm UTC](https://devforum.okta.com/t/validate-okta-audience/8052/5 "2024-01-23T20:31:13Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.