Skip to main content

Wrong token audience

typehttps://docs.frem.sh/reference/api/errors/wrong-token-audience
HTTP status403 Forbidden

What it means

You authenticated with a runner job token whose aud claim is not fremforge:attestations.

fremforge mints runner job tokens for whatever audience a job requests, including cloud federation audiences. Pinning a dedicated audience on this endpoint is what stops a token minted for one destination being replayed at another.

What to do

Request the token with that audience explicitly — getIDToken('fremforge:attestations') — and use the result here.

Response shape

All fremforge API errors are RFC 9457 problem+json:

{
  "type": "https://docs.frem.sh/reference/api/errors/wrong-token-audience",
  "title": "Forbidden",
  "status": 403,
  "detail": "..."
}

Branch on type, not on title or detail - those are human-readable and may be reworded.

Wildcard mint refused