fix(javascript-provider): request the API audience on login

packages/providers/javascript/src/provider.ts

@@ -42,7 +42,12 @@ export class JavascriptProvider implements IFastAuthProvider {
         this.client = new Auth0Client({
             domain: this.options.domain,
             clientId: this.options.clientId,
-            authorizationParams: {},
+            // Default to the network's API audience so a plain login requests it
+            // explicitly. Without it, Auth0 falls back to the tenant's Default Audience
+            // (the on-chain signing audience), which the post-login Action rejects for a
+            // login that carries no transaction payload. Signature requests override this
+            // with `signingAudience`.
+            authorizationParams: { audience: defaults.audience },
         });
     }
 

packages/providers/javascript/test/provider.spec.ts

@@ -65,6 +65,17 @@ describe("JavascriptProvider", () => {
         provider = new JavascriptProvider(mockOptions);
     });
 
+    describe("constructor", () => {
+        it("configures the network's API audience so a plain login does not inherit the tenant signing audience", () => {
+            const { Auth0Client } = jest.requireMock("@auth0/auth0-spa-js");
+            expect(Auth0Client).toHaveBeenCalledWith(
+                expect.objectContaining({
+                    authorizationParams: { audience: "https://api.testnet.fast-auth.com" },
+                }),
+            );
+        });
+    });
+
     describe("isLoggedIn", () => {
         beforeEach(() => {
             mockLocation.search = "";