@@ -4,13 +4,16 @@ title: Stateless JWT access tokens
44sidebar_label : Stateless JWT tokens
55---
66
7- # Stateless JWT access tokens
7+
88
99This document explains how to configure stateless JWT access tokens in Ory Hydra. When enabled, JWT access tokens are issued as
1010self-contained tokens without persisting them to the database, significantly improving performance for high-throughput workloads.
1111
12- Stateless JWT access tokens are available only to customers on an Ory Enterprise plan (Ory Enterprise License / Ory Network
13- Enterprise). If you are interested in this feature, please [ contact us] ( https://www.ory.sh/contact ) .
12+ ``` mdx-code-block
13+ import Help from '@site/docs/_common/need-help.mdx'
14+
15+ <Help/>
16+ ```
1417
1518## Overview
1619
@@ -23,26 +26,26 @@ tokens are issued as self-contained JWTs with a configurable boolean claim that
2326require token state (introspection, revocation, and userinfo) will return an error for these tokens.
2427
2528This feature applies when either the OAuth2 client is configured to use the JWT access token strategy or the global access token
26- strategy is set to JWT ( instead of opaque) .
29+ strategy is set to JWT instead of opaque.
2730
2831## How it works
2932
3033When stateless JWT tokens are enabled:
3134
32- 1 . ** Token Generation** : JWT access tokens are issued with an additional boolean claim (default: ` sl ` ) set to ` true ` . This claim
35+ 1 . Token Generation: JWT access tokens are issued with an additional boolean claim (default: ` sl ` ) set to ` true ` . This claim
3336 identifies the token as stateless.
3437
35- 2 . ** No Database Writes** : Access token sessions are not written to the database, eliminating write operations and improving
38+ 2 . No Database Writes: Access token sessions are not written to the database, eliminating write operations and improving
3639 performance.
3740
38- 3 . ** Stateful Operations Unavailable** : Operations that require token state return HTTP 501 (Not Implemented) with error
41+ 3 . Stateful Operations Unavailable: Operations that require token state return HTTP 501 (Not Implemented) with error
3942 ` unsupported_token_type ` :
4043
41- - ** Token Introspection** (` /oauth2/introspect ` ): Returns 501 for stateless JWT tokens
42- - ** Token Revocation** (` /oauth2/revoke ` ): Returns 501 for stateless JWT tokens
43- - ** Userinfo Endpoint** (` /userinfo ` ): Returns 501 for stateless JWT tokens
44+ - Token Introspection (` /oauth2/introspect ` ): Returns 501 for stateless JWT tokens
45+ - Token Revocation (` /oauth2/revoke ` ): Returns 501 for stateless JWT tokens
46+ - Userinfo Endpoint (` /userinfo ` ): Returns 501 for stateless JWT tokens
4447
45- 4 . ** Standard JWT Validation** : Token validation continues to work through standard JWT signature verification and claims
48+ 4 . Standard JWT Validation: Token validation continues to work through standard JWT signature verification and claims
4649 validation.
4750
4851## Configuration
@@ -113,63 +116,35 @@ Enabling stateless JWT tokens disables certain OAuth2 and OpenID Connect feature
113116
114117# ## Token introspection
115118
116- ** Endpoint** : `/oauth2/introspect`
119+ Endpoint : ` /oauth2/introspect`
117120
118121When introspecting a stateless JWT access token, the endpoint returns :
119122
120- - ** HTTP Status** : 501 Not Implemented
121- - ** Error** : `unsupported_token_type`
123+ - HTTP Status : 501 Not Implemented
124+ - Error : ` unsupported_token_type`
122125
123126Standard opaque and JWT access tokens (with stateless disabled) continue to support introspection normally.
124127
125128# ## Token revocation
126129
127- ** Endpoint** : `/oauth2/revoke`
130+ Endpoint : ` /oauth2/revoke`
128131
129132Attempting to revoke a stateless JWT access token returns :
130133
131- - ** HTTP Status** : 501 Not Implemented
132- - ** Error** : `unsupported_token_type`
134+ - HTTP Status : 501 Not Implemented
135+ - Error : ` unsupported_token_type`
133136
134137Since stateless tokens are not persisted in the database, they cannot be revoked. Token expiration is enforced through the JWT
135138` exp` claim during validation.
136139
137140# ## Userinfo endpoint
138141
139- ** Endpoint** : `/userinfo`
142+ Endpoint : ` /userinfo`
140143
141144Requesting user information with a stateless JWT access token returns :
142145
143- - ** HTTP Status** : 501 Not Implemented
144- - ** Error** : `unsupported_token_type`
146+ - HTTP Status : 501 Not Implemented
147+ - Error : ` unsupported_token_type`
145148
146149The userinfo endpoint requires database lookups to retrieve the consent session data associated with the access token, which is
147150not available for stateless tokens.
148-
149- # # When to use stateless JWT tokens
150-
151- Stateless JWT access tokens are suitable for scenarios where :
152-
153- - **High throughput is required**: Applications with high token issuance rates benefit from eliminating database writes
154- - **Token revocation is not needed**: Workloads that rely solely on JWT expiration for token lifecycle management
155- - **Introspection is not used**: Resource servers validate tokens using JWT signature verification rather than introspection
156- - **Userinfo endpoint is not required**: Client applications do not call the userinfo endpoint for user information
157- - **JWT access tokens are used**: The feature only applies when clients or the global strategy is configured for JWT tokens (not
158- opaque tokens)
159-
160- # # When not to use stateless JWT tokens
161-
162- Do not enable stateless JWT tokens if your application requires :
163-
164- - **Token revocation**: Immediate invalidation of access tokens before expiration
165- - **Token introspection**: Validating tokens through the introspection endpoint
166- - **Userinfo endpoint support**: Retrieving user information associated with access tokens
167- - **Audit trail of active tokens**: Database records of issued tokens for compliance or auditing purposes
168-
169- # # Performance considerations
170-
171- Enabling stateless JWT tokens provides performance benefits by :
172-
173- - Eliminating database write operations for access token sessions
174- - Reducing database connection pool usage during token issuance
175- - Decreasing storage requirements by not persisting JWT access tokens
0 commit comments