Auth0-spa-js: Auth0Provider no longer accepts `audience`

[stupidSheep]

Describe the problem

I've a React frontend and a Scala (Play Framework) endpoint.

• I'm using Social Login (Facebook) to obtain a token ("Application" in auth0)
• The token is (should be) used to authenticate against an API ("API" in auth0)

According to the tutorial (https://auth0.com/docs/quickstart/spa/react/02-calling-an-api) the audience parameter must be specified when performing the authentication with Social Login so to use the token on the API.

The relevant sample code shows this here: https://github.com/auth0-samples/auth0-react-samples/blob/master/02-Calling-an-API/src/index.js#L22

This - apparently - works for auth0-spa-js 1.0.2: https://github.com/auth0-samples/auth0-react-samples/blob/master/02-Calling-an-API/package.json#L19

It does not work with the latest version (1.9.0), yet the endpoint oauth/token still supports the audience parameter: https://auth0.com/docs/api/authentication#authenticate-user

What was the expected behavior?

1. Either update the documentation to reflect a new (and unknown way to me) to pass audience when performing a social login
2. Support adding audience when calling createAuth0Client

Reproduction

Follow the tutorial at https://auth0.com/docs/quickstart/spa/react/02-calling-an-api with the _latest_ auth0-spa-js version instead of an outdated (1.0.2) one

Environment

Please provide the following:

• Version of auth0-spa-js used: 1.9.0
• Which browsers have you tested in? Google Chrome
• Which framework are you using, if applicable (Angular, React, etc): React 16.13
• Other modules/plugins/libraries that might be involved:

[adamjmcgrath]

Hi @stupidSheep - thanks for your report

createAuth0Client still accepts the audience parameter in 1.9.0 and should work as expected when you provide one.

Do you have an example app I can take a look at to investigate your problem?

[stupidSheep]

Hi @adamjmcgrath Thank you for this very fast reply :) Before I use too much of your time:

1. Auth0ClientOptions does not have audience in its type definition
2.

<Auth0Provider
        domain={config.domain}
        client_id={config.clientId}
        audience={config.audience}
        redirect_uri={window.location.origin}
        onRedirectCallback={onRedirectCallback}
      >

does not add audience to the request to oauth/token

Do we talk about different things? If not, I'll fork the sample app and (try to) reproduce the issue.
I only experience the problem with my own app so there might be another problem by me

[adamjmcgrath]

Hi @stupidSheep

Auth0ClientOptions does not have audience in its type definition

Auth0ClientOptions extends BaseLoginOptions which has audience https://github.com/auth0/auth0-spa-js/blob/master/src/global.ts#L52

does not add audience to the request to oauth/token

For PKCE you should be looking for the audience in the authorize request
https://auth0.com/docs/api-auth/tutorials/authorization-code-grant-pkce#3-get-the-user-s-authorization

Feel free to share a sample app if you can repro the issue you're having

[stupidSheep]

Hi @adamjmcgrath I've tried to reproduce the issue with the sample app - and to no surprise it works flawlessly :)

For some reason I re-used the token I got from social login (by calling getIdTokenClaims and retrieving the original token using __raw)

The fact that I need to use getTokenSilently for my API call is explained in the tutorial (https://auth0.com/docs/quickstart/spa/react/02-calling-an-api#call-the-api).

I simply was already stuck with (ab-)using getIdTokenClaims and did not see the (obvious) mistake.

Please apologize - following the tutorial works without problems, so this issue can be closed.