if you are using auth0-js you will also need to make sure you are not sending any audiences with the request

any of these things can cause it to revert to RS256 tokens