Service-to-service auth: clients, audiences, and scopes

Imagine a perfectly valid token arriving at the wrong service. Its signature checks out. It has not expired. Yet accepting it would still be a mistake: it was issued for a different API. This is the part of service-to-service auth that is easy to miss when the conversation starts and ends with “we use JWTs.” When one internal service calls... Weiterlesen: Service-to-service auth: clients, audiences, and scopes