Updated by Peter Amstutz over 3 years ago
When OIDC tokens are not JWT, we should support using the OIDC standard "introspection" endpoint to verify that the token is "active"
Back