Enum VerificationStrategies 

pub enum VerificationStrategies {
    Introspection {
        introspection_uri: String,
        client_id: String,
        client_secret: String,
        use_basic_auth: bool,
        extra_params: Option<Vec<(&'static str, &'static str)>>,
    },
    JWKs {
        jwks_uri: String,
    },
    UserInfo {
        userinfo_uri: String,
    },
}

Supported OAuth token verification strategies.

Each variant represents a different method for validating access tokens, depending on what the authorization server exposes or what your application requires.

Variants

Introspection

Verifies tokens by calling the authorization server’s introspection endpoint, as defined in RFC 7662.

This method allows the resource server to validate opaque or JWT tokens by sending them to the introspection URI along with its client credentials.

Fields

introspection_uri: String

The OAuth introspection endpoint.

client_id: String

Client identifier used to authenticate the introspection request.

client_secret: String

Client secret used to authenticate the introspection request.

use_basic_auth: bool

Indicates whether the OAuth2 client should use HTTP Basic Authentication when calling the token introspection endpoint. if false: client_id and client_secret will be sent in the POST body instead of using Basic Authentication

extra_params: Option<Vec<(&'static str, &'static str)>>

Optional key-value pairs to include as additional parameters in the body of the token introspection request. Example : (“token_type_hint”, “access_token”)

JWKs

Verifies JWT access tokens using the authorization server’s JSON Web Key Set (JWKS) endpoint.

This strategy allows fully offline signature validation after retrieving the key set, making it efficient for high-throughput services.

Fields

jwks_uri: String

The JWKS endpoint URL used to retrieve signing keys.

UserInfo

Verifies tokens by querying the OpenID Connect UserInfo endpoint.

This strategy is typically used when token validity is tied to the user’s profile information or when the resource server relies on OIDC user data for validation.

Fields

userinfo_uri: String