JWT Authorization and Token Validation

• The www-authenticate header in the response from the API shows that the token wasn't issued for a valid audience.
• To authorize a request with a JWT authorizer, the JWT's aud or client_id claim must match one of the audience entries that's configured for the authorizer.
• You can also decode a JWT and verify that it matches the issuer, audience, and scopes that your API requires. The website jwt.io can debug JWTs in the browser.

Test your knowledge about JWT authorization, decoding, and token validation for APIs. This quiz covers topics such as validating audience entries, matching issuer and audience claims, and debugging JWTs using jwt.io.