Skip to content

Commit 6f689e2

Browse files
committed
docs: oauth2 stateless jwt access tokens - with pr feedback fix
1 parent 961af77 commit 6f689e2

File tree

1 file changed

+22
-50
lines changed

1 file changed

+22
-50
lines changed

docs/self-hosted/oel/oauth2/stateless-jwt.mdx

Lines changed: 22 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,14 @@ title: Stateless JWT access tokens
44
sidebar_label: Stateless JWT tokens
55
---
66

7-
# Stateless JWT access tokens
8-
97
This document explains how to configure stateless JWT access tokens in Ory Hydra. When enabled, JWT access tokens are issued as
108
self-contained tokens without persisting them to the database, significantly improving performance for high-throughput workloads.
119

12-
Stateless JWT access tokens are available only to customers on an Ory Enterprise plan (Ory Enterprise License / Ory Network
13-
Enterprise). If you are interested in this feature, please [contact us](https://www.ory.sh/contact).
10+
```mdx-code-block
11+
import Help from '@site/docs/_common/need-help.mdx'
12+
13+
<Help/>
14+
```
1415

1516
## Overview
1617

@@ -23,27 +24,26 @@ tokens are issued as self-contained JWTs with a configurable boolean claim that
2324
require token state (introspection, revocation, and userinfo) will return an error for these tokens.
2425

2526
This feature applies when either the OAuth2 client is configured to use the JWT access token strategy or the global access token
26-
strategy is set to JWT (instead of opaque).
27+
strategy is set to JWT instead of opaque.
2728

2829
## How it works
2930

3031
When stateless JWT tokens are enabled:
3132

32-
1. **Token Generation**: JWT access tokens are issued with an additional boolean claim (default: `sl`) set to `true`. This claim
33+
1. Token Generation: JWT access tokens are issued with an additional boolean claim (default: `sl`) set to `true`. This claim
3334
identifies the token as stateless.
3435

35-
2. **No Database Writes**: Access token sessions are not written to the database, eliminating write operations and improving
36+
2. No Database Writes: Access token sessions are not written to the database, eliminating write operations and improving
3637
performance.
3738

38-
3. **Stateful Operations Unavailable**: Operations that require token state return HTTP 501 (Not Implemented) with error
39+
3. Stateful Operations Unavailable: Operations that require token state return HTTP 501 (Not Implemented) with error
3940
`unsupported_token_type`:
4041

41-
- **Token Introspection** (`/oauth2/introspect`): Returns 501 for stateless JWT tokens
42-
- **Token Revocation** (`/oauth2/revoke`): Returns 501 for stateless JWT tokens
43-
- **Userinfo Endpoint** (`/userinfo`): Returns 501 for stateless JWT tokens
42+
- Token Introspection (`/oauth2/introspect`): Returns 501 for stateless JWT tokens
43+
- Token Revocation (`/oauth2/revoke`): Returns 501 for stateless JWT tokens
44+
- Userinfo Endpoint (`/userinfo`): Returns 501 for stateless JWT tokens
4445

45-
4. **Standard JWT Validation**: Token validation continues to work through standard JWT signature verification and claims
46-
validation.
46+
4. Standard JWT Validation: Token validation continues to work through standard JWT signature verification and claims validation.
4747

4848
## Configuration
4949

@@ -113,63 +113,35 @@ Enabling stateless JWT tokens disables certain OAuth2 and OpenID Connect feature
113113

114114
### Token introspection
115115

116-
**Endpoint**: `/oauth2/introspect`
116+
Endpoint: `/oauth2/introspect`
117117

118118
When introspecting a stateless JWT access token, the endpoint returns:
119119

120-
- **HTTP Status**: 501 Not Implemented
121-
- **Error**: `unsupported_token_type`
120+
- HTTP Status: 501 Not Implemented
121+
- Error: `unsupported_token_type`
122122

123123
Standard opaque and JWT access tokens (with stateless disabled) continue to support introspection normally.
124124

125125
### Token revocation
126126

127-
**Endpoint**: `/oauth2/revoke`
127+
Endpoint: `/oauth2/revoke`
128128

129129
Attempting to revoke a stateless JWT access token returns:
130130

131-
- **HTTP Status**: 501 Not Implemented
132-
- **Error**: `unsupported_token_type`
131+
- HTTP Status: 501 Not Implemented
132+
- Error: `unsupported_token_type`
133133

134134
Since stateless tokens are not persisted in the database, they cannot be revoked. Token expiration is enforced through the JWT
135135
`exp` claim during validation.
136136

137137
### Userinfo endpoint
138138

139-
**Endpoint**: `/userinfo`
139+
Endpoint: `/userinfo`
140140

141141
Requesting user information with a stateless JWT access token returns:
142142

143-
- **HTTP Status**: 501 Not Implemented
144-
- **Error**: `unsupported_token_type`
143+
- HTTP Status: 501 Not Implemented
144+
- Error: `unsupported_token_type`
145145

146146
The userinfo endpoint requires database lookups to retrieve the consent session data associated with the access token, which is
147147
not available for stateless tokens.
148-
149-
## When to use stateless JWT tokens
150-
151-
Stateless JWT access tokens are suitable for scenarios where:
152-
153-
- **High throughput is required**: Applications with high token issuance rates benefit from eliminating database writes
154-
- **Token revocation is not needed**: Workloads that rely solely on JWT expiration for token lifecycle management
155-
- **Introspection is not used**: Resource servers validate tokens using JWT signature verification rather than introspection
156-
- **Userinfo endpoint is not required**: Client applications do not call the userinfo endpoint for user information
157-
- **JWT access tokens are used**: The feature only applies when clients or the global strategy is configured for JWT tokens (not
158-
opaque tokens)
159-
160-
## When not to use stateless JWT tokens
161-
162-
Do not enable stateless JWT tokens if your application requires:
163-
164-
- **Token revocation**: Immediate invalidation of access tokens before expiration
165-
- **Token introspection**: Validating tokens through the introspection endpoint
166-
- **Userinfo endpoint support**: Retrieving user information associated with access tokens
167-
- **Audit trail of active tokens**: Database records of issued tokens for compliance or auditing purposes
168-
169-
## Performance considerations
170-
171-
Enabling stateless JWT tokens provides performance benefits by:
172-
173-
- Eliminating database write operations for access token sessions
174-
- Reducing database connection pool usage during token issuance
175-
- Decreasing storage requirements by not persisting JWT access tokens

0 commit comments

Comments
 (0)