# IdentityServer3.AccessTokenValidation

**Kind:** Service

**Source:** `Pams/API/Pams.API/Pams.API.csproj` (line 1)

**Part of:** [Pams](subsystem-pams)

NuGet package dependency

`IdentityServer3.AccessTokenValidation` is a NuGet package dependency that validates bearer access tokens issued by an IdentityServer3 authority. In this project, it supports authentication for protected API endpoints by checking incoming access tokens before application code handles requests.

## Diagram

```mermaid
sequenceDiagram
    participant Client
    participant API as Pams API
    participant Validation as IdentityServer3.AccessTokenValidation
    participant Authority as IdentityServer3 Authority

    Client->>API: Request with Authorization: Bearer token
    API->>Validation: Validate access token
    Validation->>Authority: Resolve token signing data or introspect token
    Authority-->>Validation: Token validation result
    Validation-->>API: Authenticated principal or rejection
    API-->>Client: Protected response or unauthorized response
```

## Usage

```typescript
async function getProtectedData(accessToken: string) {
  const response = await fetch("/api/protected-resource", {
    headers: {
      Authorization: `Bearer ${accessToken}`,
    },
  });

  if (!response.ok) {
    throw new Error(`API request failed: ${response.status}`);
  }

  return response.json();
}
```

## AI Coding Instructions

- Treat `IdentityServer3.AccessTokenValidation` as an API-side dependency; browser clients should send bearer tokens rather than validate them locally.
- Configure authentication middleware before protected endpoint registration so requests receive an authenticated principal.
- Keep the token authority, audience, and accepted scopes aligned with the IdentityServer3 configuration that issues tokens.
- Do not log raw access tokens, authorization headers, or token validation failures containing token contents.

## Used by

1 reference from 1 file. Each is a place in this repository where the symbol is actually used — go read one rather than trusting an example.

### Injected or called by (1)

- `Pams.API` — `Pams/API/Pams.API/Pams.API.csproj`:1