Access tokens

Access tokens issued by Anikeen ID – OAuth tokens and personal access tokens – are JWTs signed with RS256. Your own API can accept them and verify them offline with Anikeen ID's public key.

Claims

Claim	Meaning
sub	the user's Anikeen ID. In client credentials tokens (no user) it is the app's client ID, the same as aud
aud	the OAuth client (app) the token was issued to
scopes	the granted scopes; * stands for all
exp, nbf, iat	expiry, not-before and issued-at times
client beta	the app the token was issued to, see below

Verifying a token

1. Check the RS256 signature with Anikeen ID's public key. The keys are published in the SDK repository: oauth-public.key (production) and oauth-public.staging.key (staging).
2. Check exp, nbf and iat (allow a little clock skew; the SDK uses 60 seconds).
3. Look the user up by sub. A token whose sub equals aud is an app token (client credentials), not a user.
4. Check the scopes your endpoint needs.

A verified signature tells you the token was issued by Anikeen ID and not changed, but not whether the user revoked it since. To catch revoked tokens before they expire, also call GET /api/v1/user with the token (and cache the answer for a few minutes); 401 means the token is no longer valid. The SDK does this with the verify_revocation option, see API token guard.

The client claim beta

Every access token names the app it was issued to, next to aud, sub and scopes, for every grant (authorization code, refresh, client credentials, personal access tokens):

{
  "aud": "9f0c…",
  "sub": "01jexample…",
  "scopes": ["console-containers"],
  "client": {"name": "Example App", "trusted": true, "personal_access": false}
}

Field	Meaning
client.name	the app's name
client.trusted	true only for apps Anikeen marked as trusted
client.personal_access	true for personal access tokens, so a service can tell them apart from app tokens by the token alone

The claim is frozen for the token's lifetime. Tokens issued before the claim existed have none: treat them as untrusted. An app's access ends by revoking its tokens (the user removes the app under Connected apps, or Anikeen revokes the app), never by changing a token.

With the SDK, read it through anikeenTokenClientId(), anikeenTokenClientName(), anikeenTokenClientTrusted() and anikeenTokenIsPersonalAccess(), see API token guard.