Skip to main content
Question

monday-code live app JWT aud contains draft URL instead of live URL

  • June 3, 2026
  • 1 reply
  • 285 views
N

Hi monday team,

I’m debugging a monday-code live installation issue and wanted to confirm expected behavior for the signed JWT aud field.

For a new user installing the live app, the authenticated request context contains this public base URL derived from aud:

https://ee78c-service-14856766-dfa...

But the expected live app URL is:

https://live1-service-14856766-dfa...

Example log:

[userId=103522...] Authenticated monday request context: { accountId: 14856..., userId: 103522..., hasBackToUrl: true, hasShortLivedToken: true, publicBaseUrl: 'https://ee78c-service-14856766-dfa...' }

We use the JWT aud value to build OAuth redirect URIs and Google Calendar webhook URLs. If aud can contain a transient/internal service URL instead of the canonical live URL, those redirects/webhooks may be registered against the wrong host.

Is it expected that aud may point to a non-live monday-code service URL for live installations? Or should live app requests always include the canonical live URL in aud?

If this is expected behavior, what is the recommended way to reliably determine the canonical public live URL for OAuth redirects and external webhooks?

Thanks.

1 reply

dvdsmpsn
Forum|alt.badge.img+1
  • dvdsmpsn
  • Participating Frequently
  • June 5, 2026

If it’s served in the version origin/host name, the aud will contain that origin. Store an env variable for  the live origin. 

Before you do the oauth dance with Google, redirect to the live origin URL, then you’ll always be able to redirect back to the correct live origin URL. 


Build your webhooks based off the live origin too. Never the version origin. That way, you set once and don’t have to update on every version change. 

    Terms & ConditionsAccessibility statement