title: Invalid Token - The audience 'empty' is invalid
body: <p>I have the following Identity Server 4 configuration on ASP.NET Core 3.1 projects:</p>
  <pre><code>services
    .AddIdentityServer(y =&gt; {
      y.Events.RaiseErrorEvents = true;
      y.Events.RaiseInformationEvents = true;
      y.Events.RaiseFailureEvents = true;
      y.Events.RaiseSuccessEvents = true;
    })
    .AddDeveloperSigningCredential()
    .AddInMemoryPersistedGrants()
    .AddInMemoryIdentityResources(Config.IdentityResources())
    .AddInMemoryApiResources(Config.ApiResources())
    .AddInMemoryApiScopes(Config.GetApiScopes())
    .AddInMemoryClients(Config.Clients)
    .AddProfileService&lt;ProfileService&gt;()
    .AddAspNetIdentity&lt;User&gt;();
  </code></pre>
  <p>The <code>Config</code> is the following:</p>
  <pre><code>public static class Config {
  
    public static List&lt;ApiResource&gt; ApiResources() {
      return new List&lt;ApiResource&gt; { 
        new ApiResource(&quot;api&quot;, &quot;API Resource&quot;)
      };
    }
  
    public static List&lt;ApiScope&gt; ApiScopes() {
      return new List&lt;ApiScope&gt; { 
        new ApiScope(&quot;api&quot;, &quot;API Scope&quot;) 
      };
    }
  
    public static List&lt;IdentityResource&gt; IdentityResources() {
      return new List&lt;IdentityResource&gt; { 
        new IdentityResources.OpenId(),
        new IdentityResources.Profile(),
        new IdentityResources.Email() 
      };
    }   
  
    public static List&lt;Client&gt; Clients() {
      return new List&lt;Client&gt; { 
        new Client {
          ClientId = &quot;mvc&quot;,
          ClientName = &quot;MVC Client&quot;,
          AllowedGrantTypes = GrantTypes.ClientCredentials,
          ClientSecrets = { new Secret(&quot;Secret&quot;.Sha256()) }
          AllowedScopes = { 
            IdentityServerConstants.StandardScopes.OpenId,
            IdentityServerConstants.StandardScopes.Profile, 
            IdentityServerConstants.StandardScopes.Email, 
            IdentityServerConstants.StandardScopes.OfflineAccess,
            &quot;api&quot;
          }         
        }
      };
    }
  
  }
  </code></pre>
  <p>And on the API I have:</p>
  <pre><code>  services
      .AddAuthentication(IdentityServerAuthenticationDefaults.AuthenticationScheme)
      .AddIdentityServerAuthentication(IdentityServerAuthenticationDefaults.AuthenticationScheme, x =&gt; {
        x.ApiName = &quot;api&quot;;
        x.ApiSecret = &quot;Secret&quot;
        x.Authority = Config.AuthorityUrl;
        x.RequireHttpsMetadata = true;
        x.EnableCaching = true;
        x.CacheDuration = TimeSpan.FromMinutes(20);
      });
  </code></pre>
  <p>I called one API endpoint using Insomnia client with OAuth2:</p>
  <p><a href="https://i.stack.imgur.com/BOfiu.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/BOfiu.png" alt="enter image description here" /></a></p>
  <p>I was able to get the Access token but when calling the API I got the error:</p>
  <pre><code>Bearer error=&quot;invalid_token&quot;, error_description=&quot;The audience 'empty' is invalid&quot;
  </code></pre>
  <p>I checked the Access token using JWT and I got the following:</p>
  <p><strong>Header</strong></p>
  <pre><code>{
    &quot;alg&quot;: &quot;HS256&quot;,
    &quot;kid&quot;: &quot;A1042705E52832C676596F36BB1898AB&quot;,
    &quot;typ&quot;: &quot;at+jwt&quot;
  }
  </code></pre>
  <p><strong>Payload</strong></p>
  <pre><code>{
    &quot;nbf&quot;: 1598478410,
    &quot;exp&quot;: 1598482010,
    &quot;iss&quot;: &quot;https://localhost:5000&quot;,
    &quot;client_id&quot;: &quot;mvc&quot;,
    &quot;jti&quot;: &quot;23525FF997FD4D71E13C786A7AD07B5D&quot;,
    &quot;iat&quot;: 1598478410,
    &quot;scope&quot;: [
      &quot;api&quot;
    ]
  }
  </code></pre>
  <p>The <code>aud</code> is missing. But do I need it? After reading the IS4 docs I tried adding:</p>
  <pre><code>.AddIdentityServer(y =&gt; {
    y.EmitStaticAudienceClaim = true;
  </code></pre>
  <p>Now the Access token has <code>aud</code> field but its value is not <code>api</code>. Shouldn't it be?</p>
  <pre><code>&quot;aud&quot;: &quot;https://localhost:5000/resources&quot;
  </code></pre>
  <p>When calling the API I now get the error:</p>
  <pre><code>Bearer error=&quot;invalid_token&quot;, error_description=&quot;The audience 'https://localhost:5000/resources' is invalid&quot;
  </code></pre>
  <p>I read the docs and IS4 examples but couldn't find a solution.</p>
  <p>What am I missing?</p>