If you build your client applications to talk directly your OAuth2 server to obtain the JWT token, the API Management can validation that JWT Token before allowing access to your API. You can do this using the Validate-Jwt policy that looks like this if your OAuth server supports OpenId configuration:

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid."> <openid-config url="https://{Your OAuth Server}/.well-known/openid-configuration" /> <required-claims> <claim name="id" match="all"> <value>insert claim here</value> </claim> </required-claims> </validate-jwt> 

More examples of how to use this policy can be found here

If you build your client applications to talk directly to your OAuth2 server to obtain the JWT token, the API Management can validate that JWT Token before allowing access to your API. You can do this using the Validate-Jwt policy that looks like this if your OAuth server supports OpenId configuration:

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized. Access token is missing or invalid."> <openid-config url="https://{Your OAuth Server}/.well-known/openid-configuration" /> <required-claims> <claim name="id" match="all"> <value>insert claim here</value> </claim> </required-claims> </validate-jwt> 

More examples of how to use this policy can be found here