Incorrect 'aud' claim in access tokens about java-oauth-server

[TakahikoKawasaki]

Access tokens issued by Authlete are just random strings (not JWTs) unless you use Authlete version 2.1+ and configure Service.accessTokenSignAlg properly. The version of Authlete running on api.authlete.com is 1.1, so if you are using api.authlete.com, JWTs you are seeing are not access tokens. Instead, they are ID tokens.

[f74041153]

I replaced API key/secret and token value in this command with mine ,then executing it.
curl -v -X POST https://api.authlete.com/api/auth/introspection/standard \ -H "Content-Type:application/json" \ -u '10167240235:LFpGEwpyHKNYMeMHg-H339X8gXdVlix-GoCHQAjAMaE' \ -d '{ "parameters":"token=VFGsNK-5sXiqterdaR7b5QbRX9VTwVCQB87jbr2_xAI&token_type_hint=access_token" }'
The result I got after sending access token to the introspection endpoint has client_id in the 'aud' claim .

[TakahikoKawasaki]

@f74041153 Regarding the response from /api/auth/introspection/standard, we are sorry. It is a known issue in Authlete 1.1. It has already been fixed in newer versions of Authlete. If the bug in Authlete 1.1 (api.authlete.com) is critical for your project, I'll consider updating api.authlete.com.

[f74041153]

Thank you for updating api.authlete.com!
And how can I access the newer versions of Authlete ?

[TakahikoKawasaki]

@f74041153 Regarding newer versions of Authlete, please contact [email protected].

Authlete 2.1 is the latest version. It supports FAPI (Financial-grade API), CIBA (Client Initiated Backchannel Authentication), JARM (JWT Secured Authorization Response Mode for OAuth 2.0), JWT-based access tokens, etc.

One of remarkable points of the latest Authlete is that it is the world's first certified Financial-grade API (FAPI) OpenID Provider.

https://openid.net/certification/#FAPI_OPs

Please check the following articles if you are interested.

• Financial-grade API (FAPI), explained by an implementer
• “CIBA”, a new authentication/authorization technology in 2019, explained by an implementer