I've encountered a similar issue when switching from 4.5 to 4.6: http://lists.jboss.org/pipermail/keycloak-user/2018-November/016445.html I've been using the audience token mapper, which stopped working after the upgrade. Maybe these issues are related? On 11/26/18, 9:01 AM, &quot;keycloak-user-bounces(a)lists.jboss.org on behalf of Cristian Schuszter" <keycloak-user-bounces(a)lists.jboss.org on behalf of cristian.schuszter(a)cern.ch&gt; wrote: Hi! We just updated from release 4.5.0 to 4.6.0 and discovered that the "aud" field has been changed to "aud": "account", rather than the client-id of the application. After a bit of digging, we found the commit and associated pull request for the change: https://github.com/keycloak/keycloak/commit/f67d6f96607e51b1839501203342f... Unfortunately, *KEYCLOAK-8482* issue seems to be hidden, as I couldn't find it on the Jira board. We were counting on the "client_id" being present in the audiences, as the Microsoft.NET core validators target specifically the audiences in the JWT token, with no option of targeting the "azp" field. Could anybody shed some light as to why the *client_id* was removed from the audiences? Best regards, Cristian Schuszter _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user _______________________________________________ keycloak-user mailing list keycloak-user(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/keycloak-user