coinbase / coinbase/cdp-sdk

[Bug] Python JWT includes "aud": null when audience is not provided

Open Beginner friendly
#772 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
200
Forks
191
Avg merge
6h 16m
Merged PRs (30d)
17

Description

## Summary
When `audience` is not provided, the Python JWT builder includes `"aud": null` in the token payload. This can cause JWT validation failures on the server side.

## Affected Code
```python
# python/cdp/auth/utils/jwt.py
claims = {
"sub": options.api_key_id,
"iss": "cdp",
"aud": options.audience, # None → serialized as "aud": null
...
}
```

`json.dumps({"aud": None})` → `{"aud": null}` — the field is present but null.

## Fix
Only include `aud` when it's set:
```python
claims = {
"sub": options.api_key_id,
"iss": "cdp",
...
}
if options.audience:
claims["aud"] = options.audience
```

The TypeScript SDK (using `jose`) correctly omits `aud` when undefined.

## References
- TypeScript equivalent: `typescript/packages/cdp-sdk/src/auth/utils/jwt.ts`

Contributor guide

Open the contributing guide

Research direction

Start in python/cdp/auth/utils/jwt.py at the claims construction, then compare the equivalent logic in typescript/packages/cdp-sdk/src/auth/utils/jwt.ts. Verify the Python JWT payload when no audience is provided and update the behavior so the aud claim is omitted rather than serialized as null.

Written by the indexing model from the issue text.

Assessment

Tech stack
python, typescript
Domain
authentication
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
86/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.