Glossary: ASP.NET Core

Issuer and audience

Also written: iss, aud, Audience, issuer

Two JWT claims the API checks: the issuer (`iss`) is who made the token, and the audience (`aud`) is the API it is meant for. A token with the wrong audience, such as an old port's URL, is rejected with 401.