Check access token for user id before accessing backend database

[tyf]

Hey @rohit.sharma welcome to the community!

@rohit.sharma

Now we want to pass this same token to our backend api which should validate and extract the User ID from this and do restricted access operation on the database.

How can i do this. Please suggest the best practice here.

You wont be able to achieve this with an opaque access token - In order for your backend to be able to decode the payload you will need to pass a jwt. You’ll need to configure your native app(s) to pass an audience param (your API identifier) when requesting tokens for users. Some more on the audience here:

What is the Audience?

Question: What is the Audience? Answer: The audience parameter exists as part of the OAuth2.0 protocol. You can read more information from the specification here. What is it? The audience (presented as the aud claim in the access token) defines the intended consumer of the token. This is typically the resource server (API, in the dashboard) that a client (Application) would like to access. It can be added to the request to authorize i.e. audience: 'https://test-api' Here is an example where …

Hope this helps!