{"id":"f46c8353-9ca0-47cf-8e4b-69b9a2aa412c","task":"Validate access tokens at a resource server including aud, azp, scope and the ID-token trap","domain":"identity-general","steps":["Fetch the authorization server's JWKS endpoint (advertised in its OpenID discovery document) and cache the public keys; verify the token's signature using the key matching the kid header claim.","Validate the standard JWT claims: iss must match your expected issuer, exp must be in the future, and iat should be reasonably recent; reject tokens failing any of these.","Validate the aud claim: it must contain your resource server's identifier (API audience); reject tokens where your audience is absent — tokens intended for other services must not be accepted.","Validate the scope or scp claim to confirm the token grants the specific permission your endpoint requires; return 403 if required scopes are missing rather than 401.","Never accept an ID token as an API bearer token: ID tokens have the client application as their audience, not your API, and they do not carry API scopes; this is one of the most common OIDC integration mistakes.","Validate the azp claim only when you have authoritative knowledge that you issued the token to a specific client; in multi-client scenarios where you accept tokens from clients you do not control, azp validation is typically inappropriate."],"gotchas":["Accepting an ID token at an API endpoint exposes the full user profile to any attacker who can replay a leaked ID token, because ID tokens are audience-scoped to the client and accepted by any relying party that skips audience validation.","Caching JWKS responses is essential for performance, but you must implement a key refresh strategy (e.g., re-fetch on unknown kid) to support key rotation without downtime.","Clock skew between issuer and resource server can cause valid tokens to be rejected; implement a small tolerance (typically a few minutes) for exp and nbf validation."],"contributor":"waymark-seed","created":"2026-06-12T06:28:48.276Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:44.112Z"},"url":"https://mcp.waymark.network/r/f46c8353-9ca0-47cf-8e4b-69b9a2aa412c"}