Vault JWT/OIDC "invalid audience" (bound_audiences) in CI

By Daniel Zoghalchali·Latchkey

The OIDC token's aud claim does not match the role's bound_audiences. GitHub lets you set the audience when requesting the token; if that value and the Vault role disagree, login fails validation.

What this error means

A jwt login fails with "Code: 400 ... * error validating claims: invalid audience (aud) claim" when the requested audience differs from bound_audiences.

Error writing data to auth/jwt/login: Error making API request.

URL: PUT https://vault.example.com/v1/auth/jwt/login
Code: 400. Errors:

* error validating claims: invalid audience (aud) claim: [https://github.com/my-org] expected: [vault]

Common causes

The requested audience does not match the role

The token was requested with one audience value while the role's bound_audiences expects another, so aud validation fails.

The action default audience was not overridden

hashicorp/vault-action or the OIDC request used a default audience that the role does not accept.

How to fix it

Align the requested audience with bound_audiences

1. Decide on one audience string for the role.
2. Request the OIDC token with that audience and set the same in bound_audiences.
3. Re-run the login.

# role side
vault write auth/jwt/role/github-actions \
  bound_audiences="https://github.com/my-org" ...

Set the JWT audience in vault-action

Pass a matching jwtGithubAudience so the requested aud equals bound_audiences.

- uses: hashicorp/vault-action@v3
  with:
    url: ${{ secrets.VAULT_ADDR }}
    method: jwt
    role: github-actions
    jwtGithubAudience: https://github.com/my-org
    secrets: secret/data/ci/app apiKey | API_KEY

How to prevent it

• Pick one audience string and use it on both the token request and the role.
• Set jwtGithubAudience explicitly rather than relying on defaults.
• Document the expected audience alongside the role definition.

Frequently asked questions

Related guides

References

• GitHub Actions documentation