Bad Issuer on Custom Domain when using Token to Instantiate ManagementClient

Last Updated: Sep 10, 2025

Overview

This article explains a potential cause for the Bad Issuer error while using the node-auth0 SDK and a custom domain value.

Applies To

node-auth0 SDK
Token
ManagementClient

Cause

When using a token to instantiate the ManagementClient, the domain that was used to generate the token must match the domain that is configured in the ManagementClient's settings.

Solution

The node-auth0 library expects the token's Issuer to match the provided domain.

The issuer claim within the token should also match the tenant's domain that was originally used in the authentication/client credential exchange to obtain the token.

Please note that the audience will not change between tokens issued from custom or canonical/default tenant domains, as this is purely an identifier.

For example, when using a Management API access token that was issued via a custom domain, the ManagementClient instantiation would look like the below example:

new ManagementClient({
domain: "CUSTOM_DOMAIN_HERE",
token: "END-USER-ACCESS-TOKEN-HERE",
audience: "https://TENANT_CANONICAL_DOMAIN_HERE.auth0.com/api/v2/",
});

For more information on how custom domains affect API usage, please check the Related References link.

Related References

APIs