I am reading this OAuth 2.0 Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
where the authorization server issues a client a JSON web token
with the following format
{
"iss": "https://server.example.com",
"sub": "[email protected]",
"exp": 1493726400,
"nbf": 1493722800,
"cnf":{
"x5t#S256": "bwcK0esc3ACC3DB2Y5_lESsXE8o9ltc05O89jdN-dg2"
}
}
However, while I read this The OAuth 2.0 Authorization Framework it states that there exist two different types of an access token namely bearer
and MAC token.
So which one can I use? Which are the differences? Which is the format that can I use as a follow the first link? Is the token related to the grand type that is used?
As far as I understand in oauth2
the bearer token
is commonly used. Following the guide Access Token Response from here, I see that the access token has the following format
HTTP/1.1 200 OK
Content-Type: application/json
Cache-Control: no-store
Pragma: no-cache
{
"access_token":"MTQ0NjJkZmQ5OTM2NDE1ZTZjNGZmZjI3",
"token_type":"bearer",
"expires_in":3600,
"refresh_token":"IwOGYzYTlmM2YxOTQ5MGE3YmNmMDFkNTVk",
"scope":"create"
}
So how jwt
and bearer token
are used together? Which is the format used?