diff --git a/cadc-util/build.gradle b/cadc-util/build.gradle
index 0b126f90..86c11475 100644
--- a/cadc-util/build.gradle
+++ b/cadc-util/build.gradle
@@ -15,7 +15,7 @@ sourceCompatibility = 1.8
 
 group = 'org.opencadc'
 
-version = '1.12.17'
+version = '1.13.0'
 
 description = 'OpenCADC core utility library'
 def git_url = 'https://github.com/opencadc/core'
diff --git a/cadc-util/src/main/java/ca/nrc/cadc/auth/AuthorizationToken.java b/cadc-util/src/main/java/ca/nrc/cadc/auth/AuthorizationToken.java
index bef11624..3d207b52 100644
--- a/cadc-util/src/main/java/ca/nrc/cadc/auth/AuthorizationToken.java
+++ b/cadc-util/src/main/java/ca/nrc/cadc/auth/AuthorizationToken.java
@@ -68,6 +68,7 @@
 package ca.nrc.cadc.auth;
 
 import java.net.URI;
+import java.util.ArrayList;
 import java.util.List;
 
 /**
@@ -83,26 +84,26 @@ public class AuthorizationToken {
     private String credentials;
     
     // Domain-level scope.
-    private List<String> domains;
+    private List<String> domains = new ArrayList<>();
     
-    // Application-level scope.
-    private URI scope;
+    // scopes present in the token
+    private List<String> scopes = new ArrayList<>();
+    
+    // audiences present in the token
+    private List<String> audience = new ArrayList<>();
     
     /**
-     * Contructor.
+     * Standard contructor.
+     * 
      * @param type The type of the token. (eg, Bearer)
      * @param credentials The token credentials.
+     * @param domains one or more internet domains/server names where the token can be sent
      */
     public AuthorizationToken(String type, String credentials, List<String> domains) {
         this(type, credentials, domains, null);
     }
-    
-    /**
-     * Contructor.
-     * @param type The type of the token. (eg, Bearer)
-     * @param credentials The token credentials.
-     */
-    public AuthorizationToken(String type, String credentials, List<String> domains, URI scope) {
+
+    private AuthorizationToken(String type, String credentials, List<String> domains, List<String> scopes) {
         if (type == null) {
             throw new IllegalArgumentException("type required");
         }
@@ -114,8 +115,22 @@ public AuthorizationToken(String type, String credentials, List<String> domains,
         }
         this.type = type;
         this.credentials = credentials;
-        this.domains = domains;
-        this.scope = scope;
+        this.domains.addAll(domains);
+        if (scopes != null) {
+            this.scopes.addAll(scopes);
+        }
+    }
+
+    public List<String> getAudience() {
+        return audience;
+    }
+    
+    /**
+     * List of scopes for this token.
+     * @return 
+     */
+    public List<String> getScopes() {
+        return scopes;
     }
     
     /**
@@ -142,20 +157,12 @@ public List<String> getDomains() {
         return domains;
     }
     
-    /**
-     * Scope getter.
-     * @return The scope.
-     */
-    public URI getScope() {
-        return scope;
-    }
-    
     /**
      * String output.
      */
     @Override
     public String toString() {
-        return "AuthorizationToken[type=[" + type + "],domains=" + domains + ", scope=[" + scope + "]]";
+        return "AuthorizationToken[type=[" + type + "],domains=" + domains + "]";
     }
 
 }
diff --git a/cadc-util/src/main/java/ca/nrc/cadc/auth/TokenValidator.java b/cadc-util/src/main/java/ca/nrc/cadc/auth/TokenValidator.java
index 389d1cd9..9cfb85aa 100644
--- a/cadc-util/src/main/java/ca/nrc/cadc/auth/TokenValidator.java
+++ b/cadc-util/src/main/java/ca/nrc/cadc/auth/TokenValidator.java
@@ -138,7 +138,8 @@ public static Subject validateTokens(Subject subject) throws NotAuthenticatedExc
                             subject.getPrincipals().addAll(validatedToken.getIdentityPrincipals());
 
                             AuthorizationToken authToken = new AuthorizationToken(
-                                    challengeType, credentials, validatedToken.getDomains(), validatedToken.getScope());
+                                    challengeType, credentials, validatedToken.getDomains());
+                            authToken.getScopes().add(validatedToken.getScope().toASCIIString());
 
                             log.debug("Adding token credential to subject, removing token principal");
                             subject.getPublicCredentials().add(authToken);
diff --git a/cadc-util/src/test/java/ca/nrc/cadc/auth/TokenValidatorTest.java b/cadc-util/src/test/java/ca/nrc/cadc/auth/TokenValidatorTest.java
index 80003a0a..c15fb90b 100644
--- a/cadc-util/src/test/java/ca/nrc/cadc/auth/TokenValidatorTest.java
+++ b/cadc-util/src/test/java/ca/nrc/cadc/auth/TokenValidatorTest.java
@@ -139,7 +139,9 @@ public void testValidateTokens() {
             AuthorizationToken authToken = subject.getPublicCredentials(AuthorizationToken.class).iterator().next();
             Assert.assertEquals("bearer token type", AuthenticationUtil.CHALLENGE_TYPE_BEARER, authToken.getType());
             Assert.assertEquals("bearer token value", value, authToken.getCredentials());
-            Assert.assertEquals("bearer token scope", "the:scope", authToken.getScope().toString());
+            Assert.assertFalse(authToken.getScopes().isEmpty());
+            String authTokenScope = authToken.getScopes().get(0);
+            Assert.assertEquals("bearer token scope", "the:scope", authTokenScope);
             Assert.assertEquals("token principal", 0, subject.getPrincipals(AuthorizationTokenPrincipal.class).size());
             
             // ivoa tokens