title: Missing "aud" claim in access token
body: <p>For unknown reason to me the &quot;aud&quot; claim is not present in access token (it is present in id token though).</p>
  <p>Once access token is being sent to the API i get the following error:</p>
  <blockquote>
  <p>Bearer was not authenticated. Failure message: IDX10214: Audience
  validation failed. Audiences: 'empty'. Did not match:
  validationParameters.ValidAudience: 'productconfigurationapi' or
  validationParameters.ValidAudiences: 'null'.</p>
  </blockquote>
  <p>I know i can turn off audience validation and everything works then but i don't get why &quot;aud&quot; is not part of the access token.</p>
  <p>Here's my IS4 configuration:</p>
  <p>the client:</p>
  <pre><code>            new Client
              {
                  ClientId = &quot;Spa&quot;,
                  AllowedGrantTypes = GrantTypes.Implicit,
                  AllowAccessTokensViaBrowser = true,
                  AlwaysSendClientClaims = true,
                  AlwaysIncludeUserClaimsInIdToken = true,
                  AccessTokenType = AccessTokenType.Jwt,
                  AllowedScopes =
                  {
                      IdentityServerConstants.StandardScopes.OpenId,
                      IdentityServerConstants.StandardScopes.Profile,
                      &quot;productconfigurationapi&quot;
                  },
                  RequireConsent = false
              }
  </code></pre>
  <p>the api resource:</p>
  <pre><code>            new ApiResource(&quot;productconfigurationapi&quot;)
              {
                  UserClaims =
                  {
                      JwtClaimTypes.Audience
                  }
              }
  </code></pre>
  <p>the API Scope:</p>
  <pre><code>    return new List&lt;ApiScope&gt;
      {
          new ApiScope(&quot;productconfigurationapi&quot;)
      };
  </code></pre>
  <p>and here's how IS4 is configured within its host application:</p>
  <pre><code>        services.AddIdentityServer()
              .AddDeveloperSigningCredential()
              .AddConfigurationStore(options =&gt;
              {
              })
              .AddOperationalStore(options =&gt;
              {
              })
              .AddAspNetIdentity&lt;IdentityUser&gt;()
              .AddJwtBearerClientAuthentication();
  </code></pre>