OAuth2 Access Token format

Question

Trying to find information about this. I'm wondering what format the OAuth2 Access Token is, or should be. Is it ok to use JWT format for the Access Token?

I am not sure about the answer but what I do know to be very bad is if one could generate a access token by formatting userinfo in JWT. So at least make sure you prevent that. — Daan Luttik
– Daan Luttik, Commented Mar 21, 2016 at 11:03

Hans Z. · Accepted Answer · 2016-03-21 11:14:26Z

4

OAuth does not specify the access token itself, the format is opaque to the protocol flow. It can be any thing you want, e.g. a JWT if you want it to be self-contained.

answered Mar 21, 2016 at 11:14

Hans Z.

54.6k12 gold badges114 silver badges123 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

user1340582 Over a year ago

Thanks. Are there any guidelines for this? I am asking because I first thought about using JWT as it is a "standard", but now I'm wondering if it is unnecessary...

Hans Z. Over a year ago

here's some guidance: nimbusds.com/blog/implementing-oauth-2-0-access-tokens in the end it is up to the agreement between RS and AS, which does not necessarily need to be standardized

VorpalSword Over a year ago

that link's dead, do you have any others to that content, Hans?

Collectives™ on Stack Overflow

OAuth2 Access Token format

1 Answer 1

3 Comments

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Related