4 ms·
That's what the Introspection endpoint should be for.
by whatusername 8y ago
That's what the Introspection endpoint should be for.
- arkh 8y agoBut it is the problem of Oauth 2.0. Every implementer has a choice for lot of things. When you get a token you are not sure to get it as a JWT. If it is a JWT, the issuer is not enough to know what endpoints it provides. You still have to care about your clients authorization provider so you can check their access tokens. But you're building a resource server: you should not have to care about all this. Creating a resource with this identity from this issuer? Go ahead. Want to access it again? Let me check your token using this standardized token: I don't have to know if is issued by Google, the Canadian Government or your own personal server.