fix(javascript-provider): request the API audience on login

[vriveraPeersyst]

Problem

JavascriptProvider login can never succeed against a tenant whose Default Audience is the on-chain signing audience (which mainnet is).

The constructor computes defaults.audience (the network's API audience) but never uses it — the Auth0Client is built with an empty authorizationParams:

const defaults = FAST_AUTH_AUTH0_DEFAULTS[options.network]; // .audience = https://api.auth.near.org
...
this.client = new Auth0Client({
    domain, clientId,
    authorizationParams: {},   // ← API audience dropped
});

So a plain login() sends no audience → Auth0 applies the tenant Default Audience (auth0.jwt.fast-auth.near, the signing audience) → the post-login authorize-app Action denies it:

error=access_denied
error_description=Signing audience requested without transaction payload

(authorize-app.action.js: isOnchainAudience && !hasSigningPayload → deny(...); a login carries no transaction payload.)

Fix

- authorizationParams: {},
+ authorizationParams: { audience: defaults.audience },

Login now requests the API audience (https://api.auth.near.org) → event.resource_server.identifier !== ONCHAIN_AUDIENCE → the Action's if (!isOnchainAudience) return allows it. Signature requests are unaffected — requestTransactionSignature / getSignatureRequest override audience with signingAudience and send a transaction payload.

Verified

• pnpm test in packages/providers/javascript: 45/45 pass (added a regression test asserting the constructor passes the network's API audience).
• Reproduced end-to-end on a mainnet app (neartrader4, SDK 1.4.1): the redirect returned exactly ?error=access_denied&error_description=Signing%20audience%20requested%20without%20transaction%20payload. This fix makes login request the API audience instead.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
fast-auth-landing	Ready	Preview, Comment	Jul 21, 2026 4:26pm
fast-auth-spa	Ready	Preview, Comment	Jul 21, 2026 4:26pm