oc · docs
docs / documentation

@orangecheck/auth-core

@orangecheck/auth-core / AudienceRule

Type Alias: AudienceRule

type AudienceRule = string | readonly string[] | "*";

Defined in: index.ts:269

Which audience a verifier accepts.

omitted → a FAMILY session only: the token must carry no aud. a string → a token bound to that audience (or one of several). "*" → either. For the routes built to receive tokens that integrators forward.

Omitted is the strict default: a token bound to a relying party is that party's credential and never a family sign-in. Tokens minted before audiences existed carry no aud, so every existing session keeps verifying exactly as before.