Skip to content

Commit e8d867b

Browse files
committed
docs: oauth2 stateless jwt access tokens - with 'when to use' points
1 parent abf00e8 commit e8d867b

File tree

1 file changed

+26
-0
lines changed

1 file changed

+26
-0
lines changed

docs/self-hosted/oel/oauth2/stateless-jwt.mdx

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -144,3 +144,29 @@ Requesting user information with a stateless JWT access token returns:
144144
- Error: `unsupported_token_type`
145145

146146
The `/userinfo` endpoint requires database lookups to retrieve the consent session data associated with the access token.
147+
148+
## When to use stateless JWT tokens
149+
150+
Stateless JWT access tokens are suitable for scenarios where:
151+
152+
- High throughput is required: Applications with high token issuance rates benefit from eliminating database writes
153+
- Token revocation is not needed: Workloads that rely solely on JWT expiration for token lifecycle management
154+
- Introspection is not used: Resource servers validate tokens using JWT signature verification rather than introspection
155+
- Userinfo endpoint is not required: Client applications do not call the userinfo endpoint for user information
156+
- JWT access tokens are used: The feature only applies when clients or the global strategy is configured for JWT tokens
157+
158+
## When not to use stateless JWT tokens
159+
160+
Do not enable stateless JWT tokens if your application requires:
161+
162+
- Token revocation: Immediate invalidation of access tokens before expiration
163+
- Token introspection: Validating tokens through the introspection endpoint
164+
- Userinfo endpoint support: Retrieving user information associated with access tokens
165+
- Audit trail of active tokens: Database records of issued tokens for compliance or auditing purposes
166+
167+
## Performance considerations
168+
169+
Enabling stateless JWT tokens provides performance benefits by:
170+
171+
- Eliminating database write operations for access token sessions
172+
- Decreasing storage requirements by not persisting JWT access tokens

0 commit comments

Comments
 (0)