fix(python): omit the audience claim when none is given

python/cdp/auth/test/test_jwt.py

@@ -151,7 +151,7 @@ def test_generate_jwt_ec(ec_private_key_factory, jwt_options_factory):
     decoded = jwt_lib.decode(token, options={"verify_signature": False})
     assert decoded["sub"] == options.api_key_id
     assert decoded["iss"] == "cdp"
-    assert decoded["aud"] is None
+    assert "aud" not in decoded
     assert isinstance(decoded["nbf"], int)
     assert isinstance(decoded["exp"], int)
     assert decoded["exp"] - decoded["nbf"] == options.expires_in
@@ -204,7 +204,7 @@ def test_generate_websocket_jwt_ec(ec_private_key_factory, websocket_jwt_options
     decoded = jwt_lib.decode(token, options={"verify_signature": False})
     assert decoded["sub"] == options.api_key_id
     assert decoded["iss"] == "cdp"
-    assert decoded["aud"] is None
+    assert "aud" not in decoded
     assert isinstance(decoded["nbf"], int)
     assert isinstance(decoded["exp"], int)
     assert decoded["exp"] - decoded["nbf"] == options.expires_in

python/cdp/auth/utils/jwt.py

@@ -193,11 +193,15 @@ def generate_jwt(options: JwtOptions) -> str:
         claims = {
             "sub": options.api_key_id,
             "iss": "cdp",
-            "aud": options.audience,
             "nbf": now,
             "exp": now + expires_in,
         }
 
+        # The Go, Rust, TypeScript and Java generators omit an audience nobody
+        # set, and `null` is not a StringOrURI (RFC 7519 4.1.3).
+        if options.audience is not None:
+            claims["aud"] = options.audience
+
         # Add the uris claim only for JWTs intended for REST API requests, not for websocket connections
         if has_all_uri_params:
             # Build the URI claim

python/changelog.d/807.bugfix.md

@@ -0,0 +1 @@
+Fixed generate_jwt emitting a null aud claim when no audience was given.