Content
Updated by Jan Sandbrink 5 months ago
**As** an administrator
**I want to** validate the scope of JWTs
**so that** they can only be used in the context that they were intended to be used for.
**Acceptance criteria**
* For incoming JWTs, we validate the scope similar to how we do it for access tokens issued by Doorkeeper
* This means incoming JWTs need to carry a scope to be able to access our APIs (e.g. `api_v3` for requests to APIv3)
**QA Notes**
As this is an API change, it's only "Postman testable" (Postman is not a requirement, but making an API request is ;-)).
**I want to** validate the scope of JWTs
**so that** they can only be used in the context that they were intended to be used for.
**Acceptance criteria**
* For incoming JWTs, we validate the scope similar to how we do it for access tokens issued by Doorkeeper
* This means incoming JWTs need to carry a scope to be able to access our APIs (e.g. `api_v3` for requests to APIv3)
**QA Notes**
As this is an API change, it's only "Postman testable" (Postman is not a requirement, but making an API request is ;-)).