title: .net core 3.1 Bearer error="invalid_token", error_description="The audience 'empty' is invalid"
body: <p>I have 3 projects 1- Angular SPA 2- Web API Project core 3.1, 3- IdentityServer with Core 3.1
  But I am getting  following error</p>
  <pre><code>&gt; www-authenticate: Bearer error=&quot;invalid_token&quot;, error_description=&quot;The audience 'empty' is invalid&quot;
  </code></pre>
  <p>This is my API startup</p>
  <pre><code> public void ConfigureServices(IServiceCollection services)
          {
              services.Configure&lt;SchemaRegistryConfig&gt;(Configuration.GetSection(&quot;SchemaRegistryConfig&quot;));
  
  
              //identity server
  
              services.AddAuthentication(options =&gt;
                  {
                      options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                      options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
                  })
                  .AddJwtBearer(&quot;Bearer&quot;, options =&gt;
                  {
                      options.Authority = &quot;https://localhost:5002/&quot;;
                      options.RequireHttpsMetadata = false;
                      options.Audience = &quot;Api&quot;;
                  });
  
  
              IdentityModelEventSource.ShowPII = true;
  
             
              services.AddCors(c =&gt;
              {
                  c.AddPolicy(&quot;AllowOrigin&quot;, options =&gt; options.AllowAnyOrigin().AllowAnyMethod().AllowAnyHeader());
              });
  
              services.AddMvc(config =&gt;
              {
                  config.Filters.Add(typeof(UnhandledExceptionFilter));
                  config.EnableEndpointRouting = false;
              }).SetCompatibilityVersion(CompatibilityVersion.Latest);
  
              services.AddServices(Configuration);
              services.AddHealthChecksUI();                
              
            
          }
  
          
          [Obsolete]
          public void Configure(IApplicationBuilder app, IHostingEnvironment env)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
              else
              {
                  
                  app.UseHsts();
              }
              
              app.UseCors(&quot;AllowOrigin&quot;);
  
              app.UseRouting();
  
              app.UseAuthentication();
              app.UseAuthorization();        
  
              app.UseHttpsRedirection();
              app.UseMvc();
          }
  </code></pre>
  <p>Identity server config.cs</p>
  <pre><code> public static class Config
      {
          public static IEnumerable&lt;IdentityResource&gt; IdentityResources =&gt;
              new IdentityResource[]
              {               
                
                  new IdentityResources.OpenId(),
                  new IdentityResources.Email(),
                  new IdentityResources.Profile(),
                  new IdentityResources.Address(),
  
                  new IdentityResource
                  {
                      Name = &quot;Api&quot;,
                      //UserClaims =
                      //{
                      //    &quot;rc.garndma&quot;
                      //}
                  }
              };
  
         
  
          public static IEnumerable&lt;Client&gt; Clients =&gt;
              new Client[]
              {
                 
                  new Client
                  {
                      ClientName = &quot;Code Flow with refresh tokens&quot;,
                      ClientId = &quot;_client&quot;,
  
                      AccessTokenLifetime = 330,// 330 seconds, default 60 minutes
                      IdentityTokenLifetime = 45,
  
                      AllowAccessTokensViaBrowser = true,
                      RedirectUris = new List&lt;string&gt;
                      {
                          &quot;http://localhost:4200/*******&quot;
                      },
                      PostLogoutRedirectUris = new List&lt;string&gt;
                      {
                          &quot;http://localhost:4200/*******&quot;
                      },
                      AllowedCorsOrigins = new List&lt;string&gt;
                      {
                          &quot;http://localhost:4200&quot;
                      },
  
                      RequireClientSecret = false,
  
                      AllowedGrantTypes = GrantTypes.Code,
                      RequirePkce = true,
                      AllowedScopes = { &quot;openid&quot;, &quot;profile&quot;, &quot;email&quot;, &quot;Api&quot; },
  
                      AllowOfflineAccess = true,
                      RefreshTokenUsage = TokenUsage.OneTimeOnly
                  },
              };
  
  
          public static IEnumerable&lt;ApiResource&gt; GetApiResources()
          {
              return new List&lt;ApiResource&gt;
              {
                  new ApiResource(&quot;Api&quot;, &quot;Invoice API&quot;)
                  {
                      Scopes = { &quot;invoice.read&quot;, &quot;invoice.pay&quot;, &quot;manage&quot; }
                  },
              };
          }
  
          public static List&lt;ApiScope&gt; ApiScopes()
          {
              return new List&lt;ApiScope&gt; {
              new ApiScope(name: &quot;read&quot;,   displayName: &quot;Reads your invoices.&quot;),
                  new ApiScope(name: &quot;pay&quot;,    displayName: &quot;Pays your invoices.&quot;),
              };
          }
      }
  </code></pre>
  <p>identity server startup.cs</p>
  <pre><code>public void ConfigureServices(IServiceCollection services)
          {
              services.AddControllersWithViews();
  
              var builder = services.AddIdentityServer()
                  .AddInMemoryIdentityResources(Config.IdentityResources)
                  .AddInMemoryApiResources(Config.GetApiResources())
                  .AddInMemoryApiScopes(Config.ApiScopes())
                  .AddInMemoryClients(Config.Clients)
                  .AddTestUsers(TestUsers.Users);
  
  
              services.AddAuthentication();
                  
              services.AddCors(options =&gt; options.AddPolicy(&quot;AllowAll&quot;, p =&gt; 
                  p.AllowAnyOrigin()
                  .AllowAnyMethod()
                  .AllowAnyHeader()));
  
              // not recommended for production - you need to store your key material somewhere secure
              builder.AddDeveloperSigningCredential();
          }
  
          public void Configure(IApplicationBuilder app)
          {
              if (Environment.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
             
              app.UseStaticFiles();
              app.UseRouting();
              app.UseCors(&quot;AllowAll&quot;);
              app.UseIdentityServer();
             
              app.UseEndpoints(endpoints =&gt;
              {
                  endpoints.MapDefaultControllerRoute();
              });
          }
      }
  </code></pre>
  <p>Angular SPA oidc config</p>
  <pre><code>export function configureAuth(oidcConfigService: OidcConfigService) {
    return () =&gt;
      oidcConfigService.withConfig({
        stsServer: 'https://localhost:5002',
        redirectUrl: &quot;http://localhost:4200/home&quot;,
        postLogoutRedirectUri: window.location.origin,
        clientId: '_client',
        scope: 'openid profile email offline_access Api',
        responseType: 'code',
        silentRenew: true,
        useRefreshToken: true    
       
      });
  </code></pre>
  <p>My token payload is <a href="https://i.stack.imgur.com/7fMOv.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/7fMOv.png" alt="enter image description here" /></a></p>
  <p><a href="https://i.stack.imgur.com/VWDwG.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/VWDwG.png" alt="enter image description here" /></a></p>
  <p>I have 3 controllers and I added [Authorize] on each controller.
  Can anyone help me with this? I get the token generated successfully and when I am using the token to call the webapi it throwing 401 with message. But no audience is present in it.</p>