nextjs-auth0: The user does not have a valid access token via getAccessToken

This is happening on every request. Even though the proxy is working.

try {
    const tokenCache = await auth0.tokenCache(req, res);
    const { accessToken } = await tokenCache.getAccessToken();
    console.log(accessToken);
    const apiResponse = await callAPI(req.body, {
      authorization: accessToken ? `Bearer ${accessToken}` : '',
      'content-type': req.headers['content-type'],
    });
    forwardResponse(res, apiResponse);
  } catch (error) {
    console.error(error);
    res.status(error.status || 400).send({ message: error.message });
  }

The error is,

AccessTokenError: The user does not have a valid session.
    at SessionTokenCache.<anonymous> (
  name: 'AccessTokenError',
  code: 'invalid_session'
}

Our config does include the audience and refresh token.

export default initAuth0({
  audience: config.AUTH0_AUDIENCE,
  clientId: config.AUTH0_CLIENT_ID,
  clientSecret: config.AUTH0_CLIENT_SECRET,
  scope: config.AUTH0_SCOPE,
  domain: config.AUTH0_DOMAIN,
  redirectUri: config.REDIRECT_URI,
  postLogoutRedirectUri: config.POST_LOGOUT_REDIRECT_URI,
  session: {
    cookieSecret: config.SESSION_COOKIE_SECRET,
    cookieLifetime: config.SESSION_COOKIE_LIFETIME,
    storeIdToken: false,
    storeRefreshToken: true,
    storeAccessToken: true,
  },
});

Actually I take that comment back. Don’t forget that after you add an audience, the previously created users will have the wrong audience and retrieving their JWT will not work. Go under the “authorized applications” and you’ll see the wrong audience listed with old users. Revoke that and reauthorize and you should be good to go

I had the same issue and appeared to be because of misreading/misunderstanding the documentation.

For this functionality to work correctly you’ll need to persist the access token and refresh token in the session:

I thought that the above was referring to:

You can also require a scope to be present in the requested access token…

but apparently it is about the Getting an Access Token process in general. So until you set the option to persist the access token, you’ll be getting the error.

I am not sure about the storeRefreshToken option. I got it working without it (for now).

@kkomaz could you elaborate on the mismatch? I’m having the same issue where I’m getting back an access token that is not a valid jwt (much shorter) and I’ve set my scopes and api_audience.