Remote vs local verification of access token

[Cale]

Hi there. I’m going to paste this here as a general answer to local vs remote validation:

Validate tokens via /introspect vs /keys

Hi there. /introspect will always be the most secure method of token validation as it will be able to tell you if a token is still active. While caching keys to check token signatures will validate that a token is signed by the issuer, it will not catch whether a token has been revoked since being issued. As you mentioned, you will gain better performance and reduce network calls, but the tradeoff is potentially missing token revocation. However if you make your access tokens short-lived you can…

In terms of best practice, remote validation on every API call would be the most secure, but this is not feasible or realistic for a lot of customers. Depending on how much traffic your site gets, you could be hitting rate limits if you rely fully on remote token validation.