Require OAuth access tokens on the API endpoints that serve or modify protected resources: for example, /users, /orders, /files, and domain-specific actions. The resource server must validate the token and authorize the requested operation on every request.
Do not pass that business-request token to /authorize or /token. Those are authorization-server protocol endpoints with different jobs. Public health checks, discovery, documentation, JWKS, and metadata endpoints can remain unauthenticated only when your threat model and data classification permit it.
Endpoint policy at a glance
| Endpoint class | Accept the caller’s OAuth access token? | Recommended policy |
|---|---|---|
Protected business resources and actions (/users, /orders, /files) |
Yes | Require a token whenever the resource or operation is protected. Validate it and authorize the exact action on every request. |
| Public health, discovery, documentation, or login-start routes | Usually no | Keep them public only if their data and abuse risk allow it. Do not silently grant extra behavior merely because an optional token was supplied. |
Authorization endpoint (/authorize) |
No, not as a resource credential | Process authorization-request parameters and the resource-owner interaction. It is not where an API access token for the business request is presented. |
Token endpoint (/token) |
No, not the token being issued | Process a grant or refresh request, authenticate the client according to the selected grant, and issue tokens. |
| Introspection | Provider-specific | Use the server-to-server authentication required by the authorization-server deployment. |
| Revocation | Provider-specific | Apply the authorization server’s client-authentication and revocation policy. |
| JWKS and authorization-server metadata | Usually publicly retrievable | Publish keys or configuration for discovery; do not treat these as ordinary protected resources. |
| Dynamic client registration | Provider-specific | Follow the registration policy and authentication requirements; an arbitrary end-user access token is not automatically acceptable. |
What an OAuth access token is for
An access token is a credential presented to a resource server. It represents authorization granted by an authorization server for a client to perform particular operations against particular resources. The resource server—not the client—makes the final decision for each request.
A valid signature, or an active result from introspection, is only the starting point. The server must establish that the token is from an acceptable issuer, is still valid, is intended for this API, represents an allowed subject and client, and covers the requested operation under current policy.
#1 Best Overall
Which protected endpoints should require a token?
Read operations
Require a token for reads that expose non-public records, account data, private files, internal configuration, or any information whose visibility depends on the caller. A route can be read-only and still require strong authorization; confidentiality is not limited to write methods.
Write and destructive operations
Create, update, delete, export, payment, administration, and permission-changing actions should be protected by a token and usually by narrower scopes or additional policy. Authorization must cover the specific action, not merely the fact that the caller can reach the route.
Nested and object-level checks
Endpoint protection does not replace object-level authorization. After validating the token, check whether its subject, tenant, roles, scopes, and contextual rules permit access to the particular user, order, file, or other object named in the request.
Should public endpoints accept an optional token?
Usually, no. If a route is intentionally public, document that policy and return the same public representation whether the caller sends no token or an irrelevant one. Accepting an optional token can create ambiguous behavior, cache variation, and accidental privilege escalation.
Free tools Windows power users keep installed
One-click scans. No signup required.
There are legitimate designs in which a public route offers a richer representation to an authenticated caller. In that case, specify the two representations, cache keys, privacy rules, and failure behavior explicitly. A malformed token should not turn a public endpoint into an information oracle, and a valid token should not bypass object-level checks.
Where should the client send the token?
Use the HTTP authorization header:
GET /v1/orders/123 HTTP/1.1
Host: api.example.com
Authorization: Bearer ACCESS_TOKENRFC 6750 requires resource servers to support this bearer-header method. Form-body credentials are limited to requests with a defined body and the required content type. Avoid query-string tokens: URLs are commonly recorded in browser history, reverse-proxy logs, analytics systems, and referrer data.
Do not put an access token in a URL, HTML page, error message, or routine application log. Redact the header in observability pipelines and make sure intermediaries do not cache a personalized response as public content.
Validate the token on every request
Authorization is a per-request decision. Middleware should run before the handler and perform the following checks, using local JWT validation or an introspection call as appropriate:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Transport: obtain the credential from
Authorization: Bearer; reject malformed schemes and duplicate or conflicting credential locations. - Integrity and issuer: verify the signature against trusted keys, or verify an introspection response, and check the expected issuer. Reject unknown algorithms, keys, or issuers.
- Time: enforce expiration and any not-before rule with a small, documented clock-skew allowance. A token that was valid yesterday is not valid because its signature still verifies.
- Audience or resource: confirm that this token was minted for this API or resource server. Do not accept a token intended only for a different service.
- Subject and client context: identify the user or service subject and, where relevant, the client application, tenant, authentication strength, or session state.
- Scope and action: map the requested method and route to the minimum required scope or permission, then verify it. A broad scope for one resource must not imply access to another.
- Resource policy: perform ownership, tenant, role, relationship, rate, geography, and other contextual checks that claims alone cannot establish.
RFC 9068 advises using authorization claims together with other available context. RFC 9700 makes the resource-and-action check explicit: the resource server must verify for every request that the token was intended for that particular action on that particular resource.
Design scopes and audiences around real actions
Use least-privilege scopes
Prefer scopes that describe a bounded capability, such as orders:read and orders:write, over a single api:full grant. For especially sensitive operations, separate scopes for export, deletion, billing, or administration can make consent and incident response more precise.
Keep audiences resource-specific
Set an audience or resource indicator that identifies the API receiving the token. If one client calls several APIs, issue tokens for the needed resource rather than treating every service as an interchangeable audience. A gateway should not forward a token to a backend that was never its intended recipient.
Match checks to the HTTP action
Document a route-to-permission matrix. For example, GET /v1/orders/{id} may require orders:read plus a tenant or ownership check, while DELETE /v1/orders/{id} may require orders:delete and a stronger administrative policy. Test the matrix, not just the token parser.
Rank #3
What about /authorize and /token?
The authorization endpoint
/authorize starts the authorization interaction with the resource owner. The client sends parameters such as the response type, client identifier, redirect URI, requested scope, state, and (for applicable flows) a code challenge. The endpoint authenticates and obtains consent from the resource owner, then returns an authorization result. The access token that will later call an API is not supplied as the credential for this interaction.
The token endpoint
/token exchanges a grant—such as an authorization code—or processes a refresh request. It authenticates the client according to the selected grant and returns an access token, and possibly a refresh token. A previously issued access token is not a substitute for the token-endpoint authentication or grant parameters required by that deployment.
Introspection and revocation
These are authorization-server protocol endpoints, not general business resources. Introspection commonly requires server-to-server authentication because it reveals token state. Revocation accepts a revocation request under the provider’s client-authentication policy. Do not expose either endpoint as a generic bearer-token API without a deliberate design.
JWKS, metadata, and registration
JWKS and authorization-server metadata are normally retrievable for discovery and key validation. Browser access and CORS may be supported where the deployment permits it, but public reachability does not make them ordinary API resources. Dynamic client registration is provider-specific: enforce its registration policy and authentication requirements instead of accepting any access token by default.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsReturn predictable authentication failures
For a protected route with no usable credential, return an appropriate HTTP error and the RFC 6750 WWW-Authenticate challenge. Distinguish an absent credential from an invalid or insufficient one in the protocol fields your clients need, but avoid revealing whether a protected object exists.
Keep error bodies free of token contents, signing details, database identifiers, and stack traces. Log a correlation ID and a safe reason internally. Apply the same existence-hiding rule to object lookups: an unauthorized request for an existing file should not be distinguishable from a request for a file the caller cannot know about.
Rank #4
Sender constraint, lifetime, and client context
Bearer tokens can be replayed by anyone who obtains them. For higher-risk deployments, RFC 9700 recommends sender-constraining mechanisms such as mutual TLS or DPoP. Choose token lifetimes and refresh behavior according to the sensitivity and client type, and rotate signing keys without accepting untrusted algorithms during the transition.
Browser applications also require a separate delivery decision: keep tokens out of URLs and minimize exposure to scripts and third-party resources. CORS settings, cookie policies, CSRF defenses, and the OAuth profile you select must agree with the way the client actually sends credentials. A token check at the API edge cannot compensate for unsafe browser storage or an over-permissive origin policy.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →A practical implementation sequence
- Inventory every route and classify its data and actions as public, authenticated, or privileged.
- For each protected route, record the intended issuer, audience/resource, required scopes, subject or tenant rules, and whether sender constraint is required.
- Implement one shared authentication middleware that extracts the header, validates integrity and time, checks issuer and audience, and produces a normalized principal.
- Implement authorization at the handler or policy layer so method, route, object, and context are all evaluated.
- Configure protocol endpoints separately from resource routes; do not reuse business-resource middleware blindly on
/authorize,/token, introspection, revocation, metadata, or registration. - Test missing, malformed, expired, wrong-audience, wrong-scope, wrong-tenant, revoked, and sender-constraint failures, along with successful read and write cases.
- Review logs, caches, proxies, CORS, and monitoring for accidental token disclosure.
Troubleshooting common mistakes
“The signature is valid, so the request is allowed.”
Cause: signature verification was treated as authorization. Fix: enforce issuer, expiration, audience/resource, scope, subject, object, and contextual policy before the handler runs.
“The API accepts a token in the URL.”
Cause: convenience or an old client integration. Fix: migrate to the Authorization header, invalidate exposed tokens, and scrub URL and proxy logs.
“A token for Service A works on Service B.”
Cause: audience/resource validation is missing or shared signing trust is too broad. Fix: issue resource-specific tokens and reject tokens whose audience does not identify the receiving API.
“Public endpoints behave differently when a token is present.”
Cause: undocumented optional authentication. Fix: either make the route consistently public or document and test the authenticated variant, including cache and error behavior.
Best Value
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
“Clients receive a generic 401 for every failure.”
Cause: authentication and authorization failures are collapsed without a protocol challenge. Fix: send the required WWW-Authenticate challenge and an appropriate error while avoiding resource-existence leaks.
Or skip the browser setup
If you need a clean screenshot of OAuth documentation, an API reference page, or an endpoint result for a runbook, ScreenshotNeo provides a single-call website screenshot API. It accepts cookie and consent banners before capture and removes more than 60 known consent platforms, newsletter popups, and chat widgets; each step can be disabled. Bot checks, blank pages, timeouts, failed loads, and cache hits are not billed, and the response identifies the result with X-Page-Verdict and X-Billed headers.
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo documentation for options such as full-page capture, CSS selectors, custom headers and cookies, JavaScript, waiting conditions, PDF output, signed links, asynchronous jobs, bulk capture, and usage reporting. An MCP server exposes take_screenshot, get_page_info, and capture_pdf to Claude, Cursor, and other MCP clients. The Free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account.
Frequently Asked Questions
Can a single access token be valid for more than one API?
Only when the authorization design intentionally grants those resources and each receiving API accepts the token’s audience or resource indicator. Otherwise issue separate resource-specific tokens.
Should a gateway validate a token if the backend also validates it?
Yes. The gateway can reject obviously invalid requests, while the backend remains responsible for validating the token and authorizing the action because requests may reach it through another path.
Is an API key interchangeable with an OAuth access token?
No. An API key usually identifies an application or account, while an OAuth access token carries delegated authorization with resource, scope, subject, and lifetime semantics.
The Bottom Line
Put OAuth access-token enforcement on protected resource operations, validate and authorize every request for its intended resource and action, and keep authorization-server protocol endpoints on their own authentication policies.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
