#dev 2020-02-23

2020-02-23 UTC

Zegnat Basically: you can only trust tokens issued by a trusted token endpoint. (Else scopes and me value may be spoofed.) And the only way to trust the code behind a token endpoint is for you to define the token endpoint that is used