# OAuth Token Audience Guard

> OAuth Token Audience Guard is a paid API for AI agents from phion.systems, paid per call via x402, $0.002/call, status unknown (last checked 2026-09-14).

Verifies a JWT or OAuth token's declared audience (aud) and issuer (iss) claims after local cryptographic signature validation has already been performed

## Facts

- Endpoint: POST https://phion.systems/v1/paid/trust/oauth-token-audience-guard
- Price: $0.002/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/oauth-token-audience-guard-8a893904
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_9HyrGj9LEb62f3RxREJgF

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability oauth-token-audience-guard-8a893904 -d '<json body>'
```

Example prompt: After you've validated the signature on this JWT locally, check that its audience claim is set to 'https://api.myservice.com' and its issuer is 'https://auth.myidp.com' — I need to confirm this token was actually meant for my service before I accept it.

## When to prefer this

Use this endpoint when you have already performed local cryptographic signature verification on an OAuth or JWT token and need a second-layer check that the audience and issuer claims are semantically correct and match expected values. Prefer it over full token verification endpoints when cryptographic validation is handled locally (e.g. by a library) and you specifically want to guard against audience confusion attacks or issuer substitution in agent-to-agent or agent-to-service authentication flows.

## Known failure modes

- Token audience does not match expected value — returns mismatch error with found vs expected aud
- Issuer claim absent or unrecognized — returns issuer validation failure
- Malformed JWT structure prevents claim extraction — returns parse error
- Token already expired — may surface expiry warning alongside audience check
- Missing required claims in token payload — returns incomplete claims error

## How this service works

Verify declared token audience and issuer after local cryptographic validation

## Output

Returns a structured verdict indicating whether the token's declared audience and issuer match the expected values, along with any mismatch details, claim values found, and an overall trust pass/fail decision.

## Request schema (JSON Schema)

```json
{
 "$schema": "https://json-schema.org/draft/2020-12/schema",
 "type": "object"
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/oauth-token-audience-guard-8a893904/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from phion.systems](https://www.zero.xyz/host/phion.systems/llms.txt)