Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Hey! Having trouble with Ory complaining “Requested audience ‘<https://example.com>’ has not been whitelisted by the OAuth 2.0 Client”. This is an error coming from Ory’s OIDC provider when the browser does the last <https://our-app/auth/callback?code=xxx> request — However, the listed domain is 100% whitelisted in the client in exactly that format. I also get an error way earlier in the flow if the audience isn’t part of the list. Any idea what’s missing here? Or could the error message be misleading? I can’t see how it could be misconfiguration :thinking_face:

I could make this work on our dev project with things running on localhost and not a custom domain. It is _not_ working on a dev test deployment that’s running under a custom domain. Perhaps there’s something related here.