Blog

Protecting the API: Access Token Validation, Audience, Scope Policies, Client Credentials and DPoP

An API must accept not every validly signed token, but only one issued for its own audience and carrying the required scope. We wire AddJwtBearer to Keycloak, map scopes to policies, use introspection to show why a signed-out user's JWT still passes, write a DelegatingHandler that caches client credentials tokens, and verify in five scenarios that a stolen DPoP-bound token is useless.