> If you're accepting things that aren't JWTs then you're not doing oauth. As a resource server: https://tools.ietf.org/html/rfc6749#page-10 https://tools.ietf

> If you're accepting things that aren't JWTs then you're not doing oauth. As a resource server: https://tools.ietf.org/html/rfc6749#page-10 https://tools.ietf.org/html/rfc6749#page-10 Access tokens don't have to be JWT. And some OpenID authentication server give opaque tokens: your resource server has to know how to call it to check the token and get some user infos if available.