ResourceServer

A ResourceServer is a component in OAuth 2.0 and related frameworks that hosts protected resources, such as APIs, data, or services, and enforces access control based on access tokens issued by an Authorization Server. It does not issue tokens; its role is to protect resources and verify that incoming requests are authorized.

In typical interactions, a client presents an access token in a request to the ResourceServer, usually as a Bearer token in the Authorization header. The ResourceServer then validates the token to determine whether the requester is allowed to access the requested resource. Validation can occur in several ways: it may verify a self-contained JWT by checking its signature, issuer, audience, expiration, and claims using trusted public keys or a JWKS published by the Authorization Server; or it may perform token introspection by calling the Authorization Server’s introspection endpoint to learn token status and associated metadata such as scope and entitlements.

Token scopes and permissions encoded in the token guide what the client is allowed to access. The ResourceServer enforces these constraints, applying policy-based, attribute-based, or role-based access control as appropriate. It may also enforce resource-specific permissions beyond general scopes.

Security considerations include ensuring transport security with TLS, handling token revocation and rotation, and implementing efficient validation (e.g., caching introspection results or token metadata). Resource servers are commonly implemented as API gateways or backends in microservices environments and are designed to be stateless, scalable, and interoperable with standard token formats and authorization mechanisms.