Let's take an example where there are two resource servers - RS1 and RS2 and there is one authorization server - AS.

Both resource servers - RS1 and RS2 use authorization server - AS

If a client requests an access token for RS1 and passes it to RS2, how will RS2 validate it and fail?

One possibility is to depend on scope checks - but it seems scope checks are nothing more than string comparisons (or am I wrong here?). In that case, if both RS1 and RS2 define exactly the same scope name (e.g. Read) then there is no reliability even with scopes.

2 Answers 2


You can also use JSON Web Token (JWT) (https://www.rfc-editor.org/rfc/rfc7523).

The JWT includes an "aud" parameter to specify the audience of the issued token. Resources servces must check the signature of the token and the data it contains.

See https://www.rfc-editor.org/rfc/rfc7523#section-3

Another solution would be to associate a resource server to the access token by creating a new property (containing a name or url or the client_id to identify your authorized "resource server"). Then checking this parameter depends on how the communication between your authorization server and your resource servers works.


You could add some kind of namespace to the scopes. For RS1 the scopes are prefixed with "RS1::" for RS2 the scopes are prefixed with "RS2::". So if both resource servers have a scope read, the scope for RS1 would be "RS1::read" for RS2 it would be "RS2::read".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .