paskia/util/oidjwt.py

@@ -186,12 +186,18 @@ def decode_access_token(
     """
     _ensure_key()
     try:
+        # Don't pass audience if None to avoid PyJWT audience validation
+        decode_kwargs = {
+            "algorithms": ["EdDSA"],
+            "issuer": issuer,
+        }
+        if audience is not None:
+            decode_kwargs["audience"] = audience
+            
         return jwt.decode(
             token,
             _public_key,
-            algorithms=["EdDSA"],
-            issuer=issuer,
-            audience=audience,  # PyJWT handles None by skipping verification
+            **decode_kwargs
         )
     except jwt.PyJWTError as e:
         print(f"DEBUG JWT decode error: {e}")