--- title: StatelessAccessTokenResolver description: Locally resolve and validate stateless access tokens issued by AM, without referring to AM. component: pinggateway version: 7.2 page_id: pinggateway:reference:StatelessAccessTokenResolver canonical_url: https://docs.pingidentity.com/pinggateway/2026/reference/StatelessAccessTokenResolver.html llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: 2025-06-02T16:30:54Z superseded_by: https://docs.pingidentity.com/pinggateway/2026/reference/StatelessAccessTokenResolver.html section_ids: StatelessAccessTokenResolver-usage: Usage StatelessAccessTokenResolver-properties: Properties StatelessAccessTokenResolver-example: Example StatelessAccessTokenResolver-moreinfo: More information --- # StatelessAccessTokenResolver Locally resolve and validate stateless access tokens issued by AM, without referring to AM. AM can be configured to secure access tokens by signing or encrypting. The StatelessAccessTokenResolver must be configured for signature or encryption according to the AM configuration. ## Usage Use this resolver with the `accessTokenResolver` property of OAuth2ResourceServerFilter. ```json "accessTokenResolver": { "type": "StatelessAccessTokenResolver", "config": { "issuer": configuration expression, "secretsProvider": SecretsProvider reference, "verificationSecretId": configuration expression, // Use "verificationSecretId" or "decryptionSecretId": configuration expression, // "decryptionSecretId", but not both "skewAllowance": configuration expression, "signatureSecretId" : configuration expression, //deprecated "encryptionSecretId" : configuration expression //deprecated } } ``` ## Properties * `"issuer"`: *configuration expression<[string](preface.html#definition-string)>, required* URI of the AM instance responsible for issuing access tokens. * `"secretsProvider"`: *SecretsProvider [reference](preface.html#definition-reference), optional* The [SecretsProvider](secrets.html#SecretsProvider) to use to resolve queried secrets, such as passwords and cryptographic keys. Provide either the name of a SecretsProvider object defined in the heap, or specify a SecretsProvider object inline. Default: The route's default secret service. For more information, see [Default secrets object](secrets.html#default-secrets-object). * `"verificationSecretId"`: *configuration expression<[secret-id](preface.html#definition-secretid)>, required if AM secures access tokens with a signature* The secret ID for the secret used to verify the signature of signed access tokens. Depending on the type of secret store that is used to verify signatures, use the following values: * For JwkSetSecretStore, use any non-empty string that conforms to the field convention for [secret-id](preface.html#definition-secretid). The value of the string is not used. * For other types of secret stores: * `null`: No signature verification is required. * A `kid` as a string: Signature verification is required with the provided `kid`. The StatelessAccessTokenResolver searches for the matching `kid` in the SecretsProvider or global secrets service. For information about how signatures are validated, see [Validating the signature of signed tokens](../gateway-guide/about.html#secret-valid-signature). For information about how each type of secret store resolves named secrets, see [Secrets](secrets.html). Use either `verificationSecretId` or `decryptionSecretId`, according to the configuration of the token provider in AM. If AM is configured to sign **and** encrypt tokens, encryption takes precedence over signing. * `"decryptionSecretId"`: *configuration expression<[secret-id](preface.html#definition-secretid)>, required if AM secures access tokens with encryption* The secret ID for the secret used to decrypt the JWT, for confidentiality. Use either `verificationSecretId` or `decryptionSecretId`, according to the configuration of the token provider in AM. If AM is configured to sign **and** encrypt the token, encryption takes precedence over signing. - `"skewAllowance"`: *configuration expression<[duration](preface.html#definition-duration)>, optional* The duration to add to the validity period of a JWT to allow for clock skew between different servers. To support a zero-trust policy, the skew allowance is by default zero. A `skewAllowance` of 2 minutes affects the validity period as follows: * A JWT with an `iat` of 12:00 is valid from 11:58 on the IG clock. * A JWT with an `exp` 13:00 is expired after 13:02 on the IG clock. Default: `zero` * `"signatureSecretId"`: *configuration expression\, optional* | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | This property is deprecated. Use `verificationSecretId` instead. For more information, refer to [Deprecation](../release-notes/deprecated-functionality.html). | The secret ID for the secret used to verify the signature. * `"encryptionSecretId"` : *configuration expression\, optional* | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | This property is deprecated. Use `decryptionSecretId` instead. For more information, refer to [Deprecation](../release-notes/deprecated-functionality.html). | The secret ID for the secret used to decrypt data. ## Example For examples of how to set up and use StatelessAccessTokenResolver to resolve signed and encrypted access tokens, see [Validate stateless access tokens with the StatelessAccessTokenResolver](../gateway-guide/oauth2-rs.html#oauth2-rs-stateless). ## More information [org.forgerock.openig.filter.oauth2.StatelessAccessTokenResolver](../_attachments/apidocs/org/forgerock/openig/filter/oauth2/StatelessAccessTokenResolver.html) [OAuth2ResourceServerFilter](Filters.html#OAuth2ResourceServerFilter)