Skip to content

Commit 0e93007

Browse files
committed
docs: oauth2 stateless jwt access tokens - with pr feedback fix
1 parent 961af77 commit 0e93007

File tree

1 file changed

+23
-48
lines changed

1 file changed

+23
-48
lines changed

docs/self-hosted/oel/oauth2/stateless-jwt.mdx

Lines changed: 23 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,16 @@ title: Stateless JWT access tokens
44
sidebar_label: Stateless JWT tokens
55
---
66

7-
# Stateless JWT access tokens
7+
88

99
This document explains how to configure stateless JWT access tokens in Ory Hydra. When enabled, JWT access tokens are issued as
1010
self-contained tokens without persisting them to the database, significantly improving performance for high-throughput workloads.
1111

12-
Stateless JWT access tokens are available only to customers on an Ory Enterprise plan (Ory Enterprise License / Ory Network
13-
Enterprise). If you are interested in this feature, please [contact us](https://www.ory.sh/contact).
12+
```mdx-code-block
13+
import Help from '@site/docs/_common/need-help.mdx'
14+
15+
<Help/>
16+
```
1417

1518
## Overview
1619

@@ -23,26 +26,26 @@ tokens are issued as self-contained JWTs with a configurable boolean claim that
2326
require token state (introspection, revocation, and userinfo) will return an error for these tokens.
2427

2528
This feature applies when either the OAuth2 client is configured to use the JWT access token strategy or the global access token
26-
strategy is set to JWT (instead of opaque).
29+
strategy is set to JWT instead of opaque.
2730

2831
## How it works
2932

3033
When stateless JWT tokens are enabled:
3134

32-
1. **Token Generation**: JWT access tokens are issued with an additional boolean claim (default: `sl`) set to `true`. This claim
35+
1. Token Generation: JWT access tokens are issued with an additional boolean claim (default: `sl`) set to `true`. This claim
3336
identifies the token as stateless.
3437

35-
2. **No Database Writes**: Access token sessions are not written to the database, eliminating write operations and improving
38+
2. No Database Writes: Access token sessions are not written to the database, eliminating write operations and improving
3639
performance.
3740

38-
3. **Stateful Operations Unavailable**: Operations that require token state return HTTP 501 (Not Implemented) with error
41+
3. Stateful Operations Unavailable: Operations that require token state return HTTP 501 (Not Implemented) with error
3942
`unsupported_token_type`:
4043

41-
- **Token Introspection** (`/oauth2/introspect`): Returns 501 for stateless JWT tokens
42-
- **Token Revocation** (`/oauth2/revoke`): Returns 501 for stateless JWT tokens
43-
- **Userinfo Endpoint** (`/userinfo`): Returns 501 for stateless JWT tokens
44+
- Token Introspection (`/oauth2/introspect`): Returns 501 for stateless JWT tokens
45+
- Token Revocation (`/oauth2/revoke`): Returns 501 for stateless JWT tokens
46+
- Userinfo Endpoint (`/userinfo`): Returns 501 for stateless JWT tokens
4447

45-
4. **Standard JWT Validation**: Token validation continues to work through standard JWT signature verification and claims
48+
4. Standard JWT Validation: Token validation continues to work through standard JWT signature verification and claims
4649
validation.
4750

4851
## Configuration
@@ -113,63 +116,35 @@ Enabling stateless JWT tokens disables certain OAuth2 and OpenID Connect feature
113116

114117
### Token introspection
115118

116-
**Endpoint**: `/oauth2/introspect`
119+
Endpoint: `/oauth2/introspect`
117120

118121
When introspecting a stateless JWT access token, the endpoint returns:
119122

120-
- **HTTP Status**: 501 Not Implemented
121-
- **Error**: `unsupported_token_type`
123+
- HTTP Status: 501 Not Implemented
124+
- Error: `unsupported_token_type`
122125

123126
Standard opaque and JWT access tokens (with stateless disabled) continue to support introspection normally.
124127

125128
### Token revocation
126129

127-
**Endpoint**: `/oauth2/revoke`
130+
Endpoint: `/oauth2/revoke`
128131

129132
Attempting to revoke a stateless JWT access token returns:
130133

131-
- **HTTP Status**: 501 Not Implemented
132-
- **Error**: `unsupported_token_type`
134+
- HTTP Status: 501 Not Implemented
135+
- Error: `unsupported_token_type`
133136

134137
Since stateless tokens are not persisted in the database, they cannot be revoked. Token expiration is enforced through the JWT
135138
`exp` claim during validation.
136139

137140
### Userinfo endpoint
138141

139-
**Endpoint**: `/userinfo`
142+
Endpoint: `/userinfo`
140143

141144
Requesting user information with a stateless JWT access token returns:
142145

143-
- **HTTP Status**: 501 Not Implemented
144-
- **Error**: `unsupported_token_type`
146+
- HTTP Status: 501 Not Implemented
147+
- Error: `unsupported_token_type`
145148

146149
The userinfo endpoint requires database lookups to retrieve the consent session data associated with the access token, which is
147150
not available for stateless tokens.
148-
149-
## When to use stateless JWT tokens
150-
151-
Stateless JWT access tokens are suitable for scenarios where:
152-
153-
- **High throughput is required**: Applications with high token issuance rates benefit from eliminating database writes
154-
- **Token revocation is not needed**: Workloads that rely solely on JWT expiration for token lifecycle management
155-
- **Introspection is not used**: Resource servers validate tokens using JWT signature verification rather than introspection
156-
- **Userinfo endpoint is not required**: Client applications do not call the userinfo endpoint for user information
157-
- **JWT access tokens are used**: The feature only applies when clients or the global strategy is configured for JWT tokens (not
158-
opaque tokens)
159-
160-
## When not to use stateless JWT tokens
161-
162-
Do not enable stateless JWT tokens if your application requires:
163-
164-
- **Token revocation**: Immediate invalidation of access tokens before expiration
165-
- **Token introspection**: Validating tokens through the introspection endpoint
166-
- **Userinfo endpoint support**: Retrieving user information associated with access tokens
167-
- **Audit trail of active tokens**: Database records of issued tokens for compliance or auditing purposes
168-
169-
## Performance considerations
170-
171-
Enabling stateless JWT tokens provides performance benefits by:
172-
173-
- Eliminating database write operations for access token sessions
174-
- Reducing database connection pool usage during token issuance
175-
- Decreasing storage requirements by not persisting JWT access tokens

0 commit comments

Comments
 (0)