How to verify and decode multiple tokens ? about mod_oauth2

[zandbelt]

Indeed there's common data in both tokens but some fields are only present in either. Such as the email since it's not required for authorization.

you should need to do only one of those

Is there a specific reason or is it a best practice ?

it is just that I see no reason: if you're going to include identity data in the access token anyway, leaving out the email address seems arbitrary

[zandbelt]

firstly I'd say that you should need to do only one of those because it would/should render the same data; If for some reason you'd still need to consume both, the only solution is to configure token verification of one token on a specific path and then proxy internally to a different path that verifies the second token

[hollowshiroyuki]

Indeed there's common data in both tokens but some fields are only present in either. Such as the email since it's not required for authorization.

you should need to do only one of those

Is there a specific reason or is it a best practice ?

[hollowshiroyuki]

Unfortunately, I don't have control on which data is included in which token, Amazon chose to put authorization related data in one and identity related data in the other