Access Token (OAuth 2.0)

The access token is generated by the Tokens API (root) through the OAuth 2.0 endpoints and contains the account ID (sub claim) as well access scopes (scope claim). The access token can and must be used as an authorization token by any client in order to call the Quasr APIs. To do so the access token must be presented as a bearer token in the Authorization header (so Bearer JWT).

Key properties you can configure for the access token are:

• token lifetime (exp)

• token audience (aud)

• modify scopes using the extension

• add custom claims using the extension

An example access token below with default Quasr audience and your own audience (back-end).

{
  "https://api.quasr.io/claims/typ": "oauth2:access", // type
  "https://api.quasr.io/claims/max": 1973910487, // max validity
  "https://api.quasr.io/claims/use": 0, // unlimited use
  "client_id": "abe5ffb6-2f03-492d-8424-184e28685b16", // holder ID
  "scope": "openid", // access
  "sub": "ffd99cbb-f322-4dcf-8c64-48cc26c55c61", // account ID
  "jti": "f92e0e57-3e28-4d0c-a169-1b45c4efd475", // token ID
  "aud": [ "https://api.quasr.io", "https://example.com" ],
  "iss": "https://b62a482d-7365-4ae9-85a5-1453b3b0d5b9.api.quasr.io", // tenant ID
  "iat": 1642352887, // issued at
  "nbf": 1642352887, // not before
  "exp": 1673910487 // expires at
}