title: JWT multiple audiences per resource server
body: <p>After spending a number of hours researching using JWT in Web API using OWIN I'm still rather confused on what the purpose of the Audience represents. Some pages are saying that the audience is the resource server on which the token will be validated. Others suggest that audience is the client that is accessing the resource server and frequently actually refer to this value as client_id and audience interchangeably.</p>
  <p>According to the JWT spec it appears the Audience is intended to be the resource server (<a href="https://www.rfc-editor.org/rfc/rfc7519#page-9" rel="nofollow noreferrer">https://www.rfc-editor.org/rfc/rfc7519#page-9</a>). So I don't see a need to ever have more than one Audience per API application. But a number of implementations are adding multiple Audiences to a single Web API app and Microsoft's implementation of JwtBearerAuthenticationOptions allows for it as well.</p>
  <p>In these implementations where they are using the audience and the client_id interchangeably (here is one example: <a href="https://auth0.com/docs/server-apis/webapi-owin" rel="nofollow noreferrer">https://auth0.com/docs/server-apis/webapi-owin</a>) I feel this too closely couples your resource servers to your clients and is enforcing the client claim on your resource server. I feel like this is the job of the authentication server (hence the ability to add multiple audience claims to the token according to the JWT spec).</p>
  <p>I feel like I'm missing something important here. My goal is to be able to develop multiple API's that can be used by multiple clients but having to dynamically manage the audience claims at both the resource server and auth server seems to go against the spirit of JWT. Yet many people have implemented it otherwise and even MS allows multiple audiences per resource server so I was hoping for some clarity here.</p>