# Should my API differentiate between tokens?

**URL:** <https://community.auth0.com/t/should-my-api-differentiate-between-tokens/39118>\
**Category:** Get Help\
**Tags:** api\
**Created:** [March 10, 2020, 2:32am UTC](https://community.auth0.com/t/should-my-api-differentiate-between-tokens/39118 "2020-03-10T02:32:04Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![mathiasconradt](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/mathiasconradt/32/12758_2.png) [@mathiasconradt](https://community.auth0.com/u/mathiasconradt)\
**Post date:** [March 10, 2020, 7:13am UTC](https://community.auth0.com/t/should-my-api-differentiate-between-tokens/39118/2 "2020-03-10T07:13:57Z")

</div>

The authentication flows / grant types used don’t matter to the API, all that matters in the end is the token, which it needs to verify. The verification is based on signature of and claims within the token. That’s all that matters, not in which way the token has been requested.

This docs (and further linked pages) describe what standard claims to verify.

> **[Validate Access Tokens](https://auth0.com/docs/secure/tokens/access-tokens/validate-access-tokens)**
>
> Describes how to validate an access token.

Luckily the SDKs and libraries available (which you can find at the bottom of page [jwt.io](http://jwt.io)), make such token verification easy due to available helper methods.

* * *

> Is there anything in the token to differentiate how it was generated?

In a way, yes. With CCG, the `sub` claim will be a client id in the form of:

`"sub": "g3t8sYP8jvB0kHn005uF2kEA2lYAVGgZ@clients",`

for example, while with ACF, it will be a user id. So, if a `sub` is a client (application) id, it’s a hint that this token has been requested via CCG, but as said, the grant type doesn’t matter, simply base it on claims in the token.

---

_[View the full topic](https://community.auth0.com/t/should-my-api-differentiate-between-tokens/39118)._