Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something.

I understand that the client authorises with the OAuth provider (google for example) and allows the resource server to have access to the user's profile data. Then the client can send the access token to the resource server and be given back the resource.

But what does not seem to be covered in any of the documentation is what happens when the client app asks the resource server for a resource and passes it the access token. Everything I have read so far states that the resource server just responds with the requested resource.

But that seems like a huge hole, surely the resource server must somehow validate the access token, otherwise I could just fake up any old request and pass an old, stoken, fake, or randomly generated token and it would just accept it.

Can anyone point me at a simple to follow explanation of OAuth2 because so far the ones I have read feel imcomplete.

share|improve this question

Found it. Buried in the spec. They say the resource server should validate the access token with the auth server but that it's outside the scope of the document. Pity, I would have thought that token validation was an important part.

share|improve this answer
About important parts, it might be worth reading this blog post for some background on the priorities for OAuth2. – Lars Viklund Aug 2 '12 at 7:18
Thanks for that, an interesting read. My requirements are rather simple in that I want to allow an iOS app to authenticate with google, twitter, facebook, etc, pass some form of authorisation to my server and have my server validate it and enable access to resources. The problem has proved more complex than I anticipated due to the complexities of understanding how this works and what I have to do where. – drekka Aug 3 '12 at 1:10
@drekka +1 I am also struggling with oauth 2.0, if you have found any solution/implementation please point me towards those. – Gaurav Agarwal Jul 8 '13 at 17:11

Token validation is generally handled in 1 of 2 ways.

1) The token is cryptographically signed using pre shared keys. This has obvious short comings for use in distributed, proliferating systems.

2) The Authorization Server (AS) provides an endpoint for token validation or Introspection. This method was standardized in IETF RFC 7662 in October 2015, see:

This Stack Overflow Question / Answer includes examples from Google and Github:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.