An audience parameter identifies the API or resource server that an authorization request and resulting access token are intended to serve. When an identity provider exposes multiple APIs, the client includes the target API as the audience, preventing the login flow from leaving the destination ambiguous. section 8.4.1
For an admin workflow, request the admin API by setting the audience in the login redirect, then validate that same expected audience when accepting the bearer token. Audience validation works with permission checks: the admin endpoint requires both the correct audience and an admin permission. section 8.6
Requesting an admin API token
A login route redirects to the authorization endpoint with parameters such as response_type=code, client_id, redirect_uri, and audience=<audience>. After authentication, the returned authorization code is exchanged for an access token. The /admin/hello endpoint calls validate_token with the expected audience before checking whether the token permissions include admin.
