> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# OAuth and OIDC token validation and best practices

This page explains how to validate OIDC ID tokens and OAuth access tokens and summarizes recommended security practices.

## Token validation

Token validation is required to ensure your client applications and APIs trust only tokens issued for the intended audience and time window.

### OIDC ID token

An OIDC client must validate the ID token. Checks must include:

- Signature (using authorization server's JWKS keys)
- Issuer (`iss`) matches expected authorization server
- Audience (`aud`) contains client ID
- Expiration (`exp`) is valid
- Not Before (`nbf`) is valid
- Nonce (for replay protection)
- (If requested) Authentication Context Reference (`acr`) is valid
- (If requested) Authentication Time (`auth_time`) is valid

---

### OAuth access token

A resource server or an API gateway protecting a resource server must validate the access token. Checks must include:

- Signature (using authorization server's JWKS keys)
- Issuer (`iss`) matches expected authorization server
- Audience (`aud`) contains the resource being accessed
- Expiration (`exp`) is valid
- Not Before (`nbf`) is valid
- Scope (`scope`) contains the necessary scope permissions to access the requested resource
- (Optional) Client ID (`cid`) is valid

---

## Best practices

Apply the following best practices when deploying OAuth and OIDC applications:

- Always use **Authorization Code with PKCE** for mobile and web applications.
- Avoid **Implicit** flows.
- Use **HTTPS** for all authorization, token, and API traffic.
- Validate **ID token claims** carefully.
- Validate **Access token claims** carefully.
- Rotate and expire **tokens** regularly.
- Use **Refresh Tokens** securely (bound to client or resource server where possible).
- If clients support PAR, use it to protect against URL manipulation and token leakage.
- If clients support Private Key JWT, use it to authenticate clients securely.
- If Resource Server APIs support DPoP, use it to bind tokens to the client.

## Related topics

To review advanced hardening mechanisms, see [OAuth and OIDC enhanced security features](/docs/applications-and-sso/oidc/oauth-oidc-foundations/oauth-oidc-enhanced-security-features.md).