OAuth2 Resource Server explained simply

An OAuth2 Resource Server is an application that protects resources, usually APIs.

In Spring Boot, this usually means your backend receives an access token, validates it, and decides whether the request is allowed.

Imagine you have a frontend app calling a Spring Boot API:

GET /api/products
Authorization: Bearer eyJhbGciOiJSUzI1NiIs...

The API needs to answer a few questions before returning data:

• Is there a token?
• Is the token valid?
• Who is the user or client?
• What scopes, roles, or permissions does the token contain?
• Is this request allowed to access this endpoint?

Spring Security's OAuth2 Resource Server (dependency in Spring Initializr) support gives you a standard way to do that instead of writing token parsing and validation logic yourself.

The authorization server issues the token. The client sends the token. The resource server validates the token and protects the API.

Many developers mix up these three roles:

With JWTs, the token contains claims such as subject, issuer, expiration, scopes, and sometimes roles.

{
  "sub": "user-123",
  "iss": "https://auth.example.com",
  "scope": "products:read products:write",
  "exp": 1735689600
}

Spring Security checks whether the token is trustworthy. For JWTs, that usually means checking the token signature, issuer, expiration, and configured validation rules.

A typical Spring Boot resource server configuration may look like this:

@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/api/public/**").permitAll()
            .requestMatchers("/api/products/**").hasAuthority("SCOPE_products:read")
            .anyRequest().authenticated()
        )
        .oauth2ResourceServer(oauth2 -> oauth2
            .jwt()
        )
        .build();
}

This tells Spring Security that the application expects bearer tokens and should validate JWTs for protected endpoints.

If the authorization server signs JWTs with a private key, the resource server needs the matching public key to verify the signature.

In Spring Boot, this is often configured using an issuer URI:

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://auth.example.com

The resource server can use that issuer information to discover metadata and keys needed to validate incoming JWTs.

Tokens often contain permissions as scopes:

scope: "products:read products:write"

Spring Security commonly maps scopes into authorities with the prefix SCOPE_.

hasAuthority("SCOPE_products:read")

Roles are a separate concept. Some systems put roles in custom claims, such as:

{
  "roles": ["ADMIN", "SUPPORT"]
}

If your identity provider sends roles in a custom claim, you may need custom mapping logic to convert those claims into Spring Security authorities.