Hi

I have created separate Applications to give production and staging versions of an application different user lists. Both OpenID auth loops product an auth_token Cookie in the *.blah.com domain. Now we have a situation where the auth_token from prod is wrongly accepted by staging. If I attempt to check the jwt audience and reauth, I seem to get the prod cookie regardless and fall into an endless loop. So I am wondering. Is it reasonable to use Okta Apps for coarse authorization like this ? Is jwt_ audience the correct value to key off of? Should auth_tokens be constrained to tighter domain/host? Any other advice?

Thanks

Alex Mouton