ID Token Returns Incorrect JWT Signature Algorithm

When a user creates an application or client via the Management API with minimum fields, the application is created successfully. However, when the user makes a token request, the returned ID Token displays an incorrect JSON Web Token (JWT) signature algorithm compared to the configuration in the Auth0 Dashboard.

This issue occurs when using the Create a client endpoint with the following request body:

{
  "name": "Regular Web App for testing",
  "app_type": "regular_web"
}

When the user views the client in the dashboard, the JWT Signature Algorithm appears assigned at Applications > Applications > Settings > Advanced Settings > OAuth.

{
  "alg": "HS256",
  "typ": "JWT"
}

• ID Tokens
• Auth0
• Management API Client Creation

When a user creates a client in Auth0 via the Management API and does not specify the signature algorithm in the POST body, the dashboard displays a default value. However, the backend does not have an algorithm set.

This is confirmed by executing a GET request using the Get a client endpoint. The jwt_configuration object in the response does not have an algorithm set:

"jwt_configuration": {
"lifetime_in_seconds": 36000,
"secret_encoded": false
},

This behavior is a known bug with no estimated time of resolution.

To work around this issue, set the signature algorithm as part of the initial POST body.

1. Define the jwt_configuration object in the request body.

2. Set the alg property to the desired algorithm.

{
"name": "Regular Web App for testing",
"app_type": "regular_web",
"jwt_configuration": {
  "alg": "RS256",
    "lifetime_in_seconds": 36000
 }
}