{"uid":"cap_9HyrGj9LEb62f3RxREJgF","slug":"oauth-token-audience-guard-8a893904","name":"OAuth Token Audience Guard","description":"Verify declared token audience and issuer after local cryptographic validation","url":"https://phion.systems/v1/paid/trust/oauth-token-audience-guard","method":"POST","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema"},"responseSchema":null,"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.002","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"probe","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.002/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.002","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_hB0VmGy_G1K-dZwaHZcig","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.002","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Verifies a JWT or OAuth token's declared audience (aud) and issuer (iss) claims after local cryptographic signature validation has already been performed","exampleAgentPrompt":"After you've validated the signature on this JWT locally, check that its audience claim is set to 'https://api.myservice.com' and its issuer is 'https://auth.myidp.com' — I need to confirm this token was actually meant for my service before I accept it.","exampleUseCases":[{"title":"Guard against audience confusion attacks","prompt":"I just received a bearer token from an upstream agent. After verifying the signature, can you check that its aud claim matches 'https://payments.myplatform.io' and its iss is 'https://accounts.myplatform.io'? I want to make sure no one slipped in a token meant for a different service."},{"title":"Federated agent-to-agent OAuth validation","prompt":"We have two agents passing JWTs between each other. After local crypto validation, confirm that the token's issuer is 'https://identity.agentcloud.ai' and the audience is restricted to 'agent://task-executor' — I want to catch any audience mismatch before the receiving agent acts on it."},{"title":"Pre-authorization trust check in agentic workflow","prompt":"Before my agent calls the downstream data tool, validate that this OAuth token has aud set to 'https://datatool.internal' and iss matching 'https://corp-sso.example.com' — the signature is already verified, I just need the audience and issuer guard to pass."}],"resultDescription":"Returns a structured verdict indicating whether the token's declared audience and issuer match the expected values, along with any mismatch details, claim values found, and an overall trust pass/fail decision.","failureModes":["Token audience does not match expected value — returns mismatch error with found vs expected aud","Issuer claim absent or unrecognized — returns issuer validation failure","Malformed JWT structure prevents claim extraction — returns parse error","Token already expired — may surface expiry warning alongside audience check","Missing required claims in token payload — returns incomplete claims error"],"whenToPreferThis":"Use this endpoint when you have already performed local cryptographic signature verification on an OAuth or JWT token and need a second-layer check that the audience and issuer claims are semantically correct and match expected values. Prefer it over full token verification endpoints when cryptographic validation is handled locally (e.g. by a library) and you specifically want to guard against audience confusion attacks or issuer substitution in agent-to-agent or agent-to-service authentication flows.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-14T06:44:02.105Z","isFirstParty":false}