expertKeycloak, Spring Authorization Server & Microservices Security

Why doesn't a JWT token customizer (like jwtTokenCustomizer()) affect opaque tokens?

A JWT customizer runs only during the process of ENCODING a JWT at the Authorization Server — it has no relevance to opaque tokens, which are just random reference strings with no embedded, customizable claims at all. Any role/claim information for opaque tokens must instead be derived from the introspection endpoint's response structure on the resource-server side, which is a different data shape entirely.

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Sign in to generate a response

Next Step

Continue to What is the key advantage of building your own Authorization Server with Spring Authorization Server versus adopting Keycloak?← Back to all Spring Security questions