a0deploy error resource server audience duplicate import fails

Not specified by the original author.

TL;DR

One, to call the Management API you have to use the Management API audience, not a custom API audience you created in the dashboard. Two, when granting scopes, the correct name is update:usersappmetadata, not update:users or update:users_metadata.

Steps

1. Two things to check on a Bad audience error with node-auth0. One, to call the Management API you have to use the Management API audience, not a custom API audience you created in the dashboard. Two, when granting scopes, the correct name is update:usersappmetadata, not update:users or update:users_metadata. Check the Permissions tab of your API in the dashboard for the full list of valid scopes.
2. Source: https://github.com/auth0/node-auth0/issues/787 (Auth0)

When to use

You are seeing this: Two things to check on a Bad audience error with node-auth0. Use this skill when you run into "Auth0 Bad audience error".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://github.com/auth0/node-auth0/issues/787

In gh:auth0/node-auth0#787, the issue was: <!-- Please do not report security vulnerabilities here. The Responsible Disclosure Program (https://auth0.com/whitehat) details the procedure for disclosing security issues. Thank you in advance for helping us to improve this library! Please read through the template below and answer all relevant questions. Your additional work here is greatly appreciated and will help us respond as quickly as possible. For general support or usage questions, use the Auth0 Community (https://community.auth0.com/) or Auth0 Support (https://support.auth0.com/).. The verified answer: Two things to check on a Bad audience error with node-auth0. One, to call the Management API you have to use the Management API audience, not a custom API audience you created in the dashboard. Two, when granting scopes, the correct name is update:usersappmetadata, not update:users or update:users_metadata.. Issue URL: https://github.com/auth0/node-auth0/issues/787

Not specified by the original author.

Two resources with the same group/version/kind/name/namespace landed in one build - usually a diamond import (two bases both including the same shared file), a file listed twice, or an overlay listing a base plus one of its files. Find the duplicate with kustomize build on each layer, include the shared piece exactly once (or give the copies different namePrefix/nameSuffix), and rebuild.

The error

Error: accumulating resources: accumulation err='merging resources from 'b.yaml': may not add resource with an already registered id: Deployment.v1.apps/web.[noNs]'

What to do

1. Read the id in the error: Deployment.v1.apps/web.[noNs] means a Deployment named web. Expected: Identifies the colliding resource.

2. Find who includes it twice:

grep -rn 'web' overlays/*/kustomization.yaml bases/*/kustomization.yaml

Expected: Shows the double inclusion.

3. Include the shared file exactly once - restructure the bases, or differentiate with namePrefix/nameSuffix in the intermediate overlays. Expected: One copy of each id.

4. Rebuild:

kustomize build [overlay]

Expected: Build succeeds.

When this applies

• the exact may not add resource with an already registered id message
• diamond imports through shared bases
• overlays that list a base and one of its files

When it does NOT apply

• load-restrictor security errors
• patch target not found (the resource is missing, not doubled)

Works with

kustomize 4.x/5.x

Namespace.v1.[noGrp]/[name].[noNs] already registered

Same error for a duplicated Namespace - often two slots declaring the same one. Delete one.

Why it happens

Kustomize keys every resource by its full id (group, version, kind, name, namespace). Two identical ids in one build is ambiguous - it can not know which one you meant - so it errors instead of picking.

Edge cases

• namePrefix in one overlay leg of a diamond gives the copies different ids and is sometimes the intended fix.
• Components (not bases) are the mechanism for shared opt-in pieces that should not collide.

Resolved from

gh:mlopsmenacommunity/website (kustomize guide) - https://github.com/mlopsmenacommunity/website/blob/HEAD/content/student-guides/kustomize/mid-detailed.md

Asked: kustomize build fails with may not add resource with an already registered id after adding a shared base. Verified answer: Remove the duplicate inclusion (diamond import) or differentiate with namePrefix/nameSuffix. Source: https://github.com/mlopsmenacommunity/website/blob/HEAD/content/student-guides/kustomize/mid-detailed.md (thread gh:mlopsmenacommunity/website (kustomize guide)). Tool: kustomize.

Not specified by the original author.

TL;DR: An access token minted for one audience is rejected by another API. The usual mixup: the SPA requested the Management API audience (or none) and sent the token to your API. Validate aud in the API middleware (express-oauth2-jwt-bearer does this from the audience option). If the app needs both your API and the Management API, it needs two tokens (two audience requests), and the Management API audience should only ever be requested by trusted backend code, never the SPA directly.

Wrong audience

The error

Your API returns 401, and decoding the token shows aud is not your API identifier. Common values seen: the Management API audience (YOUR_HOST/api/v2/), or an opaque token (no aud at all, just a random string).

Why

• No audience requested: Auth0 returns an opaque token usable only against /userinfo. Your API cannot validate it.
• Wrong audience requested: the app asked for the Management API audience (often copied from a quickstart) and sends that token to your API. Audiences are not interchangeable.
• Multiple APIs: the app calls API A with a token minted for API B. One token, one audience (plus the /userinfo sidecar).

Fix

1. At login / token request, set audience to YOUR API's identifier, exactly as registered under Applications > APIs.
2. Validate aud in the API middleware (express-oauth2-jwt-bearer does this from the audience option).
3. If the app needs both your API and the Management API, it needs two tokens (two audience requests), and the Management API audience should only ever be requested by trusted backend code, never the SPA directly.

The node-auth0 variant

Calling the Management API from Node requires the Management API audience AND the right scopes (read:users etc). "Bad audience" there means the token was minted for your custom API. Separate token, separate audience.

Checklist

• aud in the decoded token equals the API identifier, character for character.
• Management API tokens never minted for or sent by the frontend.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: Token has the wrong audience.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current Token behavior.

Auth0's API authorization docs define the audience parameter and the API identifier. The backend quickstart shows validating the audience in middleware. The Management API audience requirement is documented in the Management API docs. Verified against live docs 2026-09-26.