Auth0 is sending a RS256 signed token instead of HS256 signed token

Question

I am trying to obtain an auth token with Auth0 java client.

In Auth0, I have a non interactive client. JsonWebToken Signature Algorithm is set to HS256 in the client. I use following code to obtain the token.

AuthAPI auth = new AuthAPI("my.domain", "my_client_id", "my_client_secret");
AuthRequest request = auth.login("username", "password").setAudience("my_audience");
TokenHolder holder = request.execute();

But, the token I receive is signed with RS256 instead of HS256.

What could be the problem here?

Answer 1

This is expected behaviour. The JWT Access token is signed by your API (the audience is set to the Identifier of the API) and not by the Client.

From the Auth0 Dashboard, check under APIs, and you'll find what the API is using. It is recommended always to use (prefer) RS256.

If you need any further info, please leave me comments.