---
title: Validating PingAM stateless access tokens
description: Configure PingGateway to validate PingAM stateless access tokens using a PingAmStatelessAccessTokenResolver for signed and encrypted tokens
component: pinggateway
version: 2026
page_id: pinggateway:gateway-guide:oauth2-rs-stateless
canonical_url: https://docs.pingidentity.com/pinggateway/2026/gateway-guide/oauth2-rs-stateless.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
revdate: 2026-09-15T08:44:10Z
---

# Validating PingAM stateless access tokens

The StatelessAccessTokenResolver confirms that stateless access tokens provided by AM are well-formed, have a valid issuer, have the expected access token name, and have a valid signature.

After the StatelessAccessTokenResolver resolves an access token, the OAuth2ResourceServerFilter checks that the token is within the expiry time, and that it provides the required scopes. Learn more in [PingAmStatelessAccessTokenResolver](../reference/PingAmStatelessAccessTokenResolver.html).

The following pages show how to validate signed and encrypted access tokens:

* [With JwkSetSecretStore and PingAM](oauth2-rs-stateless-signed-sat.html)

* [Signed PingAM tokens with KeyStoreSecretStore](oauth2-rs-stateless-signed-ksss.html)

* [Encrypted PingAM tokens with KeyStoreSecretStore](oauth2-rs-stateless-encrypted.html)