Applying APIM policies based on client - jwt

Question

I want to apply some APIM policies based on the clientId from which the request is coming from.
I want to validate the tokens coming from a particular client for certain claims and not for rest of the clients.
I am trying it by various ways, but none works and makes the policy return 500 internal server error for each request.
Can anyone help me know what am I doing wrong or how can this be done.
<set-variable name="authToken" value="#(context.Request.Headers.GetValueOrDefault("Authorization","Bearer").Split(' ').Last())" />
<choose>
<when condition = "#(((Jwt)(context.Variables["authToken"])).Claims["appid"].Contains("{{particularAppClientId}}"))">
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid.">
<openid-config url="https://login.microsoftonline.com/some_tenant_id/.well-known/openid-configuration" />
<audiences>
<audience>{{clientId}}</audience>
<audience>{{ResourceId}}</audience>
</audiences>
<issuers>
<issuer>https://sts.windows.net/some_tenant_id/</issuer>
</issuers>
<required-claims>
<claim name="roles" match ="any">
<value>Task.Write</value>
<value>App.Setup</value>
</claim>
</required-claims>
</validate-jwt>
</when>
<otherwise>
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid.">
<openid-config url="https://login.microsoftonline.com/some_tenant_id/.well-known/openid-configuration" />
<audiences>
<audience>{{clientId}}</audience>
<audience>{{ResourceId}}</audience>
</audiences>
<issuers>
<issuer>https://sts.windows.net/some_tenant_id/</issuer>
</issuers>
</validate-jwt>
</otherwise>
</choose>

Answer 1

Could you try getting and setting the token as follows instead?
context.Request.Headers.GetValueOrDefault("Authorization",string.Empty).Split(' ').Last().AsJwt()
The rest of the implementation, conditional, etc, looks valid to me as it aligns with the official sample: https://learn.microsoft.com/en-us/azure/api-management/policies/authorize-request-based-on-jwt-claims