2026-09-24 · 6 min read · Rahul Chitturi
- oauth
- jwt
- security
OAuth resource indicators let a client identify the protected resource for which it wants authorization or an access token. They help an authorization server issue audience-restricted tokens instead of broad bearer credentials accepted by unrelated APIs.
A request can still fail when the client sends the wrong resource URI, the server applies different policy at authorization and token endpoints, or an API validates scope but ignores audience.
Map the complete request flow
Record the registered client, issuer metadata, authorization request, token request, grant type, resource values, requested scopes, resulting token format, documented audience, and receiving API. Redact codes, tokens, client credentials, and user identifiers.
- Compare resource URIs as defined by server policy.
- Do not derive trust from a token's unverified claims.
- Bind each token cache entry to resource and scope.
- Reject tokens intended for another API.
Separate selection from validation
The authorization server decides whether requested resources are permitted and how they map to token audience. The resource server independently verifies signature or introspection results, issuer, audience, expiration, token type, and required authorization.
Do not rewrite resource values from untrusted forwarding headers or silently fall back to a broader token after an audience error. Multiple-resource behavior must follow the provider profile rather than client guesswork.
Use disposable protocol fixtures
Use Flashman's URL tool for harmless resource identifiers, JWT decoder for synthetic token structures, JSON formatter for sanitized metadata, and diff for request traces. Perform verification with a maintained OAuth library.
Test omitted, one, repeated, malformed, unauthorized, and redirected resource values; authorization-code and refresh flows; token exchange if supported; cache isolation; audience arrays; opaque tokens; issuer mix-ups; and API gateway forwarding.