library · inferred from evidence
express-oauth2-jwt-bearer
A library used for JWT authentication and scope enforcement in Express.js applications.
- Token has the wrong audience: API identifier vs Management API audience
An access token minted for one audience is rejected by another API. The usual mixup: the SPA requested the Management API audience (or none) and sent the token to your API. Not for different error messages.
- M2M scopes end to end: register API, add permissions, authorize app, request scopes
Scopes fail when any of the four steps is skipped: define the permission on the API, grant it to the app, request it in the token call, enforce it in the API. Debug by walking the chain in order. Not the full reference manual.