--- title: "Security Best Practices: Validating Audience (aud) Claims in ZITADEL Access Tokens" description: Learn why relying solely on the aud claim in ZITADEL-issued tokens is insecure and how to properly validate Access Tokens using roles, scopes, and token introspection. --- [Skip to content](https://help.zitadel.com/security-best-practices-validating-audience-aud-claims-in-zitadel-access-tokens#main-content) [![zitadel-logo\_text-dark (1)](https://help.zitadel.com/hs-fs/hubfs/zitadel-logo_text-dark%20(1).png?width=210&height=60&name=zitadel-logo_text-dark%20(1).png)](https://help.zitadel.com/?hsLang=en) Open main navigation Close main navigation - [Documentation](https://zitadel.com/docs) [Documentation](https://zitadel.com/docs) How can we help you? - There are no suggestions because the search field is empty. 1. [ZITADEL Knowledge Base](https://help.zitadel.com/?hsLang=en) 2. [Security & Compliance](https://help.zitadel.com/security-compliance?hsLang=en) July 21, 2025 # Security Best Practices: Validating Audience (aud) Claims in ZITADEL Access Tokens ## Understanding risks and implementing effective mitigations beyond audience checks ### **Problem Overview** In OAuth 2.0, the audience (`aud`) claim indicates the intended recipient of a token. A client must verify the tokens audience claims and ensure that at least one audience value matches its unique identifier. While verifying aud is essential, using it as your sole authorization check is insufficient. ZITADEL allows clients to request arbitrary audience scopes (`urn:zitadel:iam:org:project:id:{projectID}:aud`), resulting in tokens that include an audience even if the user lacks explicit permissions for that audience. Relying solely on aud can therefore grant unauthorized access if additional checks are not implemented. ### **Current ZITADEL Behavior** - When requesting the `urn:zitadel:iam:org:project:id:{projectID}:aud` scope, ZITADEL issues access tokens containing the requested aud claims without verifying the requesting user's grants. - Token introspection correctly reports such tokens as inactive (**active: false**) if the audience is unauthorized, helping prevent misuse. - In the [Project Role Settings](https://zitadel.com/docs/guides/manage/console/projects#role-settings), you can enable the following checks for human users performing an interactive login flow: - **Check authorization on Authentication**: If set, users are only allowed to authenticate if any role is assigned to their account. - **Check for Project on Authentication**: It is checked whether the user's organization has this project. If not, the user cannot be authenticated. ### **Recommended Mitigations** To securely handle ZITADEL-issued access tokens, implement the following best practices: 1. **Layered Authorization Checks:** - Always verify specific roles, scopes or custom claims in addition to checking the aud claim. You should also check the `iss` claim, signature and expiration of the token. - Reject tokens lacking the necessary roles or custom claims, even if the audience matches. 2. **Token Introspection:** - Use ZITADEL’s [introspection](https://zitadel.com/docs/guides/integrate/token-introspection) endpoint to confirm token validity, roles, and active state. - Reject tokens reported inactive (**active: false**) or without sufficient privileges. These measures align with OAuth 2.0 best practices and RFC guidance ([RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749#section-7), [RFC 8707](https://www.rfc-editor.org/rfc/rfc8707.html#name-security-considerations)), ensuring robust and secure API access control. - [Getting Started](https://help.zitadel.com/getting-started?hsLang=en) - [User Management](https://help.zitadel.com/user-management?hsLang=en) - [Authentication & Login](https://help.zitadel.com/authentication-login?hsLang=en) - [Security & Compliance](https://help.zitadel.com/security-compliance?hsLang=en) - [Troubleshooting](https://help.zitadel.com/troubleshooting?hsLang=en) - [Account & Subscription](https://help.zitadel.com/account-subscription?hsLang=en#main-content) - [Support](https://help.zitadel.com/account-subscription?hsLang=en#support) - [Billing (Pro)](https://help.zitadel.com/account-subscription?hsLang=en#billing-pro) - [Billing (Enterprise)](https://help.zitadel.com/account-subscription?hsLang=en#billing-enterprise) - [Zitadel Cloud Account](https://help.zitadel.com/account-subscription?hsLang=en#zitadel-cloud-account) - [Service Description](https://help.zitadel.com/account-subscription?hsLang=en#service-description) - [Default Settings](https://help.zitadel.com/default-settings?hsLang=en#main-content) - [Web Keys](https://help.zitadel.com/default-settings?hsLang=en#web-keys) - [Self-Hosting](https://help.zitadel.com/self-hosting?hsLang=en) [![zitadel-logo\_text-dark](https://help.zitadel.com/hs-fs/hubfs/zitadel-logo_text-dark.png?width=210&height=60&name=zitadel-logo_text-dark.png "zitadel-logo_text-dark")](http://zitadel.com) 1 Embarcadero Center, Suite 1200 San Francisco, CA 94111 Copyright © 2025 All rights reserved.