How to Stop Getting JWEs when JWT is Required
Sep 10, 2025
Overview
When calling `/oauth/token`, a JSON Web Encryption (JWE) token is received when a JSON Web Token (JWT) is desired. This article explains the steps required to get a JWT.
Applies To
- Resource Servers
- APIs
- Access Tokens
Cause
Whether a JWE or a JWT when calling the `token' is returned is configured at the Resource Server/ API level. See Configure JSON Web Encryption for more information
Solution
Check the audience being passed in the requests.
- See Get Access Tokens for more details.
Whichever API's identifier is being used as the audience parameter would need to be changed to toggle off JWE as per the documentation here:
- See Configure JSON Web Encryption for more information
Please note that if no audience is provided, Auth0 will issue an opaque token instead, which is only intended for use with the tenant's `/userinfo` endpoint as described in the following documentation
