https://sauvikbiswas.com/tags/token-exchange/ Recent content in Token-Exchange on Sauvik Biswas Hugo en-us Sat, 27 Jun 2026 00:00:00 +0000 https://sauvikbiswas.com/posts/learning-oauth-2-10/ Sat, 27 Jun 2026 00:00:00 +0000 https://sauvikbiswas.com/posts/learning-oauth-2-10/ <h2 class="heading" id="why-resource-binding-alone-is-not-enough"> Why resource binding alone is not enough <a class="anchor" href="#why-resource-binding-alone-is-not-enough">#</a> </h2> <p><a href="https://sauvikbiswas.com/posts/learning-oauth-2-09/">v09</a> binds each access token to a named API at mint time. The client sends <code>resource</code> on authorize and token; the auth server sets JWT <code>aud</code> (or introspection <code>aud</code>) to that URI. Gated routes on the resource server reject tokens bound to the wrong API.</p> <p>That fixes which API may accept a given token. It does not fix who may present the token, or how a middle tier gets a downstream token without asking the user to log in again.</p>