diff --git a/descope/internal/mgmt/sso_test.go b/descope/internal/mgmt/sso_test.go
index c7064cd9..2bb338e1 100644
--- a/descope/internal/mgmt/sso_test.go
+++ b/descope/internal/mgmt/sso_test.go
@@ -1569,6 +1569,7 @@ func TestLoadXAASettingsSuccess(t *testing.T) {
 		"groupPriorityEnabled": true,
 		"allowOverrideRoles":   true,
 		"providerID":           "prov1",
+		"audience":             "https://api.descope.com/v1/apps/P1",
 	}
 	mgmt := newTestMgmt(nil, helpers.DoOkWithBody(func(r *http.Request) {
 		require.Equal(t, r.Header.Get("Authorization"), "Bearer a:key")
@@ -1594,6 +1595,8 @@ func TestLoadXAASettingsSuccess(t *testing.T) {
 	assert.True(t, res.GroupPriorityEnabled)
 	assert.True(t, res.AllowOverrideRoles)
 	assert.EqualValues(t, "prov1", res.ProviderID)
+	// Read-only, project-level: no tenant segment - the tenant travels in the aud_tenant claim.
+	assert.EqualValues(t, "https://api.descope.com/v1/apps/P1", res.Audience)
 }
 
 func TestLoadXAASettingsErrorMissingTenantID(t *testing.T) {
diff --git a/descope/types.go b/descope/types.go
index aae297f3..e24a2d46 100644
--- a/descope/types.go
+++ b/descope/types.go
@@ -1744,6 +1744,10 @@ type SSOXAASettingsResponse struct {
 	GroupPriorityEnabled bool                        `json:"groupPriorityEnabled,omitempty"`
 	AllowOverrideRoles   bool                        `json:"allowOverrideRoles,omitempty"`
 	ProviderID           string                      `json:"providerID,omitempty"` // selected IdP provider template id (display metadata; mirrors SSOSAMLSettings providerID)
+	// Audience is read-only: the project-level audience a requesting application must present in its
+	// ID-JAG token. It carries no tenant segment - it equals the issuer the project publishes - so the
+	// identity provider must send the tenant id in the token's aud_tenant claim.
+	Audience string `json:"audience,omitempty"`
 }
 
 type SSOXAAAllSettingsResponse struct {