aud
requiredscope: openid (required)Type: string or array of strings
aud (audience) contains the client_id(s) that the ID Token is intended for. Clients MUST reject tokens where their client_id is not in aud. This prevents a token obtained for application A from being used at application B.
Details
The aud claim restricts which clients may use the token.
Validation: the client MUST verify that its client_id appears in the aud claim. If aud is an array, client_id must be one of the values. If client_id is not in aud, reject the token immediately.
aud can be a string or array: String: aud = 'client_abc' – single intended audience Array: aud = ['client_abc', 'client_xyz'] – multiple audiences
Multiple audiences and azp: when aud is an array, the authorized party claim (azp) identifies which client is presenting the token. The client MUST verify that either azp equals its client_id, or that it is the only entry in aud.
Security: without aud validation, a malicious service could obtain a token using its own client_id and then present that token to your service. Aud validation prevents this cross-client token reuse attack.
Example Values
| Label | Value |
|---|---|
| Single audience (string) | "your-client-id.apps.googleusercontent.com" |
| Multiple audiences | ["client_abc", "client_xyz"] |
Validation Rules
MUST be present in every ID Token
Client MUST reject token if its client_id is not listed in aud
If aud is array with multiple values, verify azp claim equals this client's client_id
NEVER skip aud validation – it prevents cross-client token reuse