---
title: Validate stateless access tokens
description: Configure PingGateway to validate PingAM stateless access tokens using StatelessAccessTokenResolver for signed and encrypted tokens
component: pinggateway
version: 2024.11
page_id: pinggateway:gateway-guide:oauth2-rs-stateless
canonical_url: https://docs.pingidentity.com/pinggateway/2026/gateway-guide/oauth2-rs-stateless.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-06-02T09:47:34Z
superseded_by: https://docs.pingidentity.com/pinggateway/2026/gateway-guide/oauth2-rs-stateless.html
---

# Validate stateless access tokens

The StatelessAccessTokenResolver confirms that stateless access tokens provided by AM are well-formed, have a valid issuer, have the expected access token name, and have a valid signature.

After the StatelessAccessTokenResolver resolves an access token, the OAuth2ResourceServerFilter checks that the token is within the expiry time, and that it provides the required scopes. For more information, refer to [StatelessAccessTokenResolver](../reference/StatelessAccessTokenResolver.html).

The following pages show how to validate signed and encrypted access tokens:

* [With JwkSetSecretStore](oauth2-rs-stateless-signed-sat.html)

* [Signed tokens with KeyStoreSecretStore](oauth2-rs-stateless-signed-ksss.html)

* [Encrypted tokens with KeyStoreSecretStore](oauth2-rs-stateless-encrypted.html)