2022-07-30 UTC
# 
[schmarty] it seems that the only token verification mechanism in the spec now is via introspection endpoint, and the introspection endpoint "must" require some form of authorization. for now i am supporting "Bearer" in my setup, but i realize that introduces a challenge for services like Aperture which is built to support multiple users and their indieauth implementations.