# Jwt authorization

**URL:** <https://devforum.okta.com/t/jwt-authorization/22194>\
**Category:** OAuth/OIDC\
**Created:** [October 19, 2022, 12:12pm UTC](https://devforum.okta.com/t/jwt-authorization/22194 "2022-10-19T12:12:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sid303](https://avatars.discourse-cdn.com/v4/letter/s/e9bcb4/32.png) [@Sid303](https://devforum.okta.com/u/Sid303)\
**Post date:** [October 19, 2022, 12:12pm UTC](https://devforum.okta.com/t/jwt-authorization/22194/1 "2022-10-19T12:12:43Z")

</div>

I’m working on a new application where we own the front end and backend. I’ve created the okta config using SPA with authorization with pkce grant flow for front end and client credentials flow for backend java (both OIDC).  
Once I get the id token and access token in react using sdk, how to authorize the jwt token?

Do I need to use aws gateway to authorize it or it can be done in backend using any server side language like JAVA.

We have multiple consumers who will use our backend along with us so want to know what is the correct way to approach this scenario.

---

<div class="post-metadata">

**Author:** ![andrea](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/andrea/32/2172_2.png) [@andrea](https://devforum.okta.com/u/andrea)\
**Post date:** [October 19, 2022, 3:19pm UTC](https://devforum.okta.com/t/jwt-authorization/22194/2 "2022-10-19T15:19:45Z")

</div>

Typically, your backend would accept the user’s Access Tokens as bearer auth in the request headers and [validate it server-side](https://developer.okta.com/docs/guides/validate-access-tokens/). Highly recommend that if you have multiple OIDC clients sending tokens to this same resource server that they share an authorization server (will make the validation simpler that way).

---

<div class="post-metadata">

**Author:** ![Sid303](https://avatars.discourse-cdn.com/v4/letter/s/e9bcb4/32.png) [@Sid303](https://devforum.okta.com/u/Sid303)\
**Post date:** [October 19, 2022, 3:39pm UTC](https://devforum.okta.com/t/jwt-authorization/22194/3 "2022-10-19T15:39:01Z")

</div>

Sure thank you, will try it.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [February 12, 2024, 10:14pm UTC](https://devforum.okta.com/t/jwt-authorization/22194/4 "2024-02-12T22:14:15Z")

</div>

Closed on February 12, 2024, 10:14pm UTC

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.