Resource servers

A resource server accepts tokens only from its configured tenant issuer and for its own audience.

Validation checklist

1. Resolve discovery and JWKS from the configured issuer.
2. Verify the JWT signature against an allowed algorithm and current tenant key.
3. Require exact iss equality.
4. Require the expected resource audience.
5. Validate expiration and not-before times with a bounded clock skew.
6. Enforce the scopes needed by the requested operation.
7. Where live revocation or current account state is required, use authenticated introspection with a tenant credential issued for that resource.
8. Resolve the product identity from exact (iss, sub).
9. Enforce product organization, role and permission rules in the product backend.

Identity authentication does not replace product authorization. A valid token proves the Identity subject and granted OAuth scopes; it does not by itself grant a LookAndTry organization membership or business permission.

First access

Provisioning a new product profile from a verified email is a product decision. Linking an existing profile must use an explicit migration or account-linking operation. Never attach an existing profile solely because the token email matches it.