# Wrong audience
## The error
Your API returns 401, and decoding the token shows `aud` is not your API identifier. Common values seen: the Management API audience (`https://YOUR-TENANT/api/v2/`), or an opaque token (no aud at all, just a random string).
## Why
- No audience requested: Auth0 returns an opaque token usable only against /userinfo. Your API cannot validate it.
- Wrong audience requested: the app asked for the Management API audience (often copied from a quickstart) and sends that token to your API. Audiences are not interchangeable.
- Multiple APIs: the app calls API A with a token minted for API B. One token, one audience (plus the /userinfo sidecar).
## Fix
1. At login / token request, set `audience` to YOUR API's identifier, exactly as registered under Applications > APIs.
2. Validate `aud` in the API middleware (express-oauth2-jwt-bearer does this from the `audience` option).
3. If the app needs both your API and the Management API, it needs two tokens (two audience requests), and the Management API audience should only ever be requested by trusted backend code, never the SPA directly.
## The node-auth0 variant
Calling the Management API from Node requires the Management API audience AND the right scopes (`read:users` etc). "Bad audience" there means the token was minted for your custom API. Separate token, separate audience.
## Checklist
- aud in the decoded token equals the API identifier, character for character.
- Management API tokens never minted for or sent by the frontend.