> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Manage Resource Servers

Use this section to configure resource server APIs/URLs and OAuth scopes in IDaaS so client applications can request JWT access tokens to access protected resources on behalf of users.

## When to use this section

Use this section when you need to:

- Expose APIs/URLs as protected resources in IDaaS.
- Define scopes that control what client applications can access.
- Validate JWT access tokens in your APIs before allowing access.

Consider the following example:

example

Bank ABC wants to be able to provide a trusted client application access to user mortgage capability so partners can issue mortgage quotes to customers. Bank ABC creates a user mortgage API/URL and adds it as an authorized API/URL in IDaaS and provides corresponding scopes (`view:mortgage`, `add:mortgage`, `edit:mortgage`, `remove:mortgage`). The scopes correspond to the permissions the client application can request on behalf of the user. Bank ABC protects the mortgage API/URL by validating the JWT access tokens issued by IDaaS and presented by the client application.

## Limitations

The following are OAuth maximums:

- Maximum of 100 APIs or URLs
- Maximum of 100 scopes per API or URL
- Maximum of 100 authorization roles

## Topics in this section

[📄️Add a resource server Manage OAuth authorization with a resource server.](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/manage-resource-servers/add-an-api-url-resource-server.md)

[📄️Role-Based Access Control (RBAC) Role-based access control allows you to configure the scopes that are contained within OAuth access tokens requested by client applications on behalf of users in order to access protected APIs/URLs. You create Access Management Roles and link them to scopes and users. Consider the following example:](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/manage-resource-servers/configure-role-based-access-control-rbac.md)

[📄️Client credential grants For each resource server you define, you can configure OIDC and OAuth Web and Server applications to request a JWT access token by using the client credentials grant. The client application uses this token to call the resource server API directly.](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/manage-resource-servers/configure-client-credential-grants.md)

## See also

For details about token behavior and lifecycle controls, see:

[Manage OIDC and OAuth tokens](/docs/applications-and-sso/manage-applications/integrate-oidc-and-oauth-cloud-applications/manage-oidc-and-oauth-tokens.md)