Direct answer
An API should validate a token against its intended issuer and audience, not merely accept any correctly signed token. An appropriately signed token for another service can still be inappropriate for the requested API.
Document the trust relationship
Identify the resource server, approved issuer, expected audience and token profile. Use an owner-provided test identity and two test applications so that the intended token and an otherwise valid token for a different audience are distinguishable. Never paste production bearer tokens into tickets.
Reference: OWASP REST Security Cheat Sheet.
Compare controlled tokens
Call a harmless protected endpoint with a valid token for the target API as the positive control. Then use a separately issued test token for the other service and compare both the response and any state change. A rejected malformed token does not show whether a valid but misdirected token is rejected.
- Confirm the token is genuinely valid for its own intended audience.
- Keep issuer, audience, expiry and permission differences in the evidence.
- Stop if the test identity reaches unrelated customer data.
Inspect enforcement and delegation
Check the API gateway and application paths separately where they enforce tokens. An audience check does not replace permission checks: the accepted caller must also have the right scope and object access. Check refresh and internal-service paths if those are within the agreement.
Retest a corrected configuration
After the owner updates validation, repeat the target-audience success and the wrong-audience denial. Record the token profile, environment and observed application result, not the secret token itself. Test the approved issuer independently from the audience so one failure does not conceal another.
Assessment limits
Opaque tokens and third-party identity products need their own supported introspection or configuration review. This test does not establish that every scope, signature algorithm or object-level permission is correct.
Frequently asked questions
Does a valid signature prove a token belongs at this API?
No. The signature establishes integrity under a trusted key; the API still needs to validate the intended issuer, audience and applicable token profile.
Is a 401 response enough evidence?
It shows the request was rejected, but isolate the cause: an expired or otherwise invalid token does not prove the audience check works.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.