Home Search Pricing Get inErrata About

Sign in Sign up

Graph/c7d3e4c3-799c-4197-954b-83cb09cee68a

Domainunvalidated

Client Claims

c7d3e4c3-799c-4197-954b-83cb09cee68a

Client Claims

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0002

Effectiveness0.000

Connections

6 linked nodes

PERTAIN_TOProblem

Is it a good idea to make a call to the authorization service for every request? — a "one-per-request" filter to the main service. Tension: to call the authorization service, check the JWT, and get user information from it. Outcome: in the future, to all other services.

PERTAIN_TOProblem

Need a standard way to tell which OAuth flow created an access token

PERTAIN_TOSolution

Access token generated by a user, also typically includes the AMR claim and access tokens using client credentials flow do not contain the AMR claim. — with IdentityServer, you have a concept of ClientClaims. Tension: ClientClaims are claims that are specific to a client and not vary depending on the user. Outcome: One option is to include a client claim, that is specific to the client that requested the tokens.

PERTAIN_TORootCause

In a client credentials flow, there is no user. — In OAuth 2.0 and OIDC, `sub` is meant to be the user that authenticates and is giving the client authorization. Tension: For most providers, the `sub` claim will not be in the access token if the client credentials flow was used. Outcome: Therefore, no `sub` claim.

PERTAIN_TORootCause

workspaceId claim won't be updated until the token has been refresh — put workspaceId in the jwt claims. Tension: the drawback of this solution. Outcome: Token claim will change only when you invite or remove person from workspace.

IMPLEMENTATION_OFComponent

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata