Skip to main content

OAuth and OIDC token validation and best practices

This page explains how to validate OIDC ID tokens and OAuth access tokens and summarizes recommended security practices.

Token validation​

Token validation is required to ensure your client applications and APIs trust only tokens issued for the intended audience and time window.

OIDC ID token​

An OIDC client must validate the ID token. Checks must include:

  • Signature (using authorization server's JWKS keys)
  • Issuer (iss) matches expected authorization server
  • Audience (aud) contains client ID
  • Expiration (exp) is valid
  • Not Before (nbf) is valid
  • Nonce (for replay protection)
  • (If requested) Authentication Context Reference (acr) is valid
  • (If requested) Authentication Time (auth_time) is valid

OAuth access token​

A resource server or an API gateway protecting a resource server must validate the access token. Checks must include:

  • Signature (using authorization server's JWKS keys)
  • Issuer (iss) matches expected authorization server
  • Audience (aud) contains the resource being accessed
  • Expiration (exp) is valid
  • Not Before (nbf) is valid
  • Scope (scope) contains the necessary scope permissions to access the requested resource
  • (Optional) Client ID (cid) is valid

Best practices​

Apply the following best practices when deploying OAuth and OIDC applications:

  • Always use Authorization Code with PKCE for mobile and web applications.
  • Avoid Implicit flows.
  • Use HTTPS for all authorization, token, and API traffic.
  • Validate ID token claims carefully.
  • Validate Access token claims carefully.
  • Rotate and expire tokens regularly.
  • Use Refresh Tokens securely (bound to client or resource server where possible).
  • If clients support PAR, use it to protect against URL manipulation and token leakage.
  • If clients support Private Key JWT, use it to authenticate clients securely.
  • If Resource Server APIs support DPoP, use it to bind tokens to the client.

To review advanced hardening mechanisms, see OAuth and OIDC enhanced security features.