{"action":"created","issue":{"url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/596","labels_url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/596/labels{/name}","comments_url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/596/comments","events_url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/596/events","html_url":"https://github.com/bshaffer/oauth2-server-php/issues/596","id":80292572,"number":596,"title":"Validating request from another subdomain","user":{"login":"JerryBels","id":4408419,"avatar_url":"https://avatars.githubusercontent.com/u/4408419?v=3","gravatar_id":"","url":"https://api.github.com/users/JerryBels","html_url":"https://github.com/JerryBels","followers_url":"https://api.github.com/users/JerryBels/followers","following_url":"https://api.github.com/users/JerryBels/following{/other_user}","gists_url":"https://api.github.com/users/JerryBels/gists{/gist_id}","starred_url":"https://api.github.com/users/JerryBels/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/JerryBels/subscriptions","organizations_url":"https://api.github.com/users/JerryBels/orgs","repos_url":"https://api.github.com/users/JerryBels/repos","events_url":"https://api.github.com/users/JerryBels/events{/privacy}","received_events_url":"https://api.github.com/users/JerryBels/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2015-05-24T22:38:09Z","updated_at":"2015-05-26T21:53:16Z","closed_at":null,"body":"Hello, and thank you for this awesomeness !\r\n\r\nI'm trying to implement an API where the users would authenticate using oauth2 tokens. The thing is, I want the API to be on its own subdomain (api.example.com) and the oauth2 server on another (auth.example.com). My API is built using Laravel, but on the auth subdomain I simply followed your step-by-step http://bshaffer.github.io/oauth2-server-php-docs/cookbook/\r\n\r\nSo, I successfully got a token back using Postman to test the URL auth.example.com/token.php with id, pass and grant_type in post. The question is : \r\n\r\nHow, in my other subdomain api.example.com (or even on the main domain example.com, that will handle the website later, built also with Laravel) can I check the token and who it is authenticating ?\r\n\r\nThanks a lot ahead !"},"comment":{"url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/comments/105678041","html_url":"https://github.com/bshaffer/oauth2-server-php/issues/596#issuecomment-105678041","issue_url":"https://api.github.com/repos/bshaffer/oauth2-server-php/issues/596","id":105678041,"user":{"login":"phindmarsh","id":344000,"avatar_url":"https://avatars.githubusercontent.com/u/344000?v=3","gravatar_id":"","url":"https://api.github.com/users/phindmarsh","html_url":"https://github.com/phindmarsh","followers_url":"https://api.github.com/users/phindmarsh/followers","following_url":"https://api.github.com/users/phindmarsh/following{/other_user}","gists_url":"https://api.github.com/users/phindmarsh/gists{/gist_id}","starred_url":"https://api.github.com/users/phindmarsh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/phindmarsh/subscriptions","organizations_url":"https://api.github.com/users/phindmarsh/orgs","repos_url":"https://api.github.com/users/phindmarsh/repos","events_url":"https://api.github.com/users/phindmarsh/events{/privacy}","received_events_url":"https://api.github.com/users/phindmarsh/received_events","type":"User","site_admin":false},"created_at":"2015-05-26T21:53:16Z","updated_at":"2015-05-26T21:53:16Z","body":"@JohnAdamsy thats pretty much exactly what I outlined above. \r\n\r\nYou have your AS issue [JWT access tokens](http://bshaffer.github.io/oauth2-server-php-docs/overview/jwt-access-tokens/), which are JSON objects that have been base 64 encoded and signed with a secret key. Then all you need is a JWT lib on your RS (in any language), decode the token, verify the signature, and if all good you can trust the contents of the token to be what the AS issued in the first place. If you have AS and RS that are physically separated and you do not wish to write a bridge to the AS for each request to the RS then this is the way to do it. As I said, I've implemented it and it works perfectly. \r\n\r\n@JerryBels On that note, if the codebase issuing tokens (authorization server) is the same as your API (resource server) then you can use the `verifyResourceRequest` method of the Resource Controller to do exactly that (see the _Create a Resource Controller_ of the [cookbook page](http://bshaffer.github.io/oauth2-server-php-docs/cookbook/)) . That only falls over if you have different codebases/apps, as hinted by @JohnAdamsy above). In that case I'd recommend the JWT token route. It is very simple to implement, just follow the [JWT access token docs](http://bshaffer.github.io/oauth2-server-php-docs/overview/jwt-access-tokens/)."}}