Tokens and identity

Treat access_token as opaque

OAuth access_token is the Bearer credential for business APIs. The implementation supports opaque tokens; clients must not assume JWT format or infer identity and permissions from an unverified payload.

Use GET /v1/users/me for an authorized user's profile. Business APIs validate credentials for ordinary SDK calls; manual introspection is not required first.

OIDC id_token serves a different purpose: it verifies sign-in identity and is not a business API Bearer credential. Configure OIDC clients through the actual issuer discovery document and validate signature, iss, aud, exp and nonce. Do not hard-code an API-domain issuer or JWKS address from historical examples.

Production accounts issuer is https://accounts.appforges.com; staging is https://accounts-staging.appforges.com. See OAuth overview.