title: OAuth2 returning JWT in place of access_token
body: <p>I am currently in the process of building an OAuth2 provider using the bshaffer PHP library <a href="https://github.com/bshaffer/oauth2-server-php" rel="nofollow">here</a>.</p>
  
  <p>I've found IETF <a href="http://www.ietf.org/id/draft-ietf-oauth-jwt-bearer-11.txt" rel="nofollow">draft specifications</a> that outline the implementations that specifically call out the usage of JSON Web Tokens as an authorization grant and client authentication. </p>
  
  <p>The implementation that interests me however is returning a JWT in place of the regular access token, as seen <a href="http://bshaffer.github.io/oauth2-server-php-docs/overview/crypto-tokens/" rel="nofollow">here</a>. In case of dead link, the access token response is pasted below. </p>
  
  <pre><code>{    
      "access_token":"eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9.eyJpZCI6IjYzMjIwNzg0YzUzODA3ZjVmZTc2Yjg4ZjZkNjdlMmExZTIxODlhZTEiLCJjbGllbnRfaWQiOiJUZXN0IENsaWVudCBJRCIsInVzZXJfaWQiOm51bGwsImV4cGlyZXMiOjEzODAwNDQ1NDIsInRva2VuX3R5cGUiOiJiZWFyZXIiLCJzY29wZSI6bnVsbH0.PcC4k8Q_etpU-J4yGFEuBUdeyMJhtpZFkVQ__sXpe78eSi7xTniqOOtgfWa62Y4sj5Npta8xPuDglH8Fueh_APZX4wGCiRE1P4nT4APQCOTbgcuCNXwjmP8znk9F76ID2WxThaMbmpsTTEkuyyUYQKCCdxlIcSbVvcLZUGKZ6-g",
      "client_id":"CLIENT_ID",
      "user_id":null,
      "expires":1382630473,
      "scope":null
  }
  </code></pre>
  
  <p>It returns a JWT in place of the regularly generated access token for the normal authorization grants. Client and User credentials grants are the more important for me as we are only dealing in 1st party API access. </p>
  
  <p>This implementation seems to be ideal, because I do not need to maintain a store of generated tokens, limiting the amount of infrastructure that is required. At some point if we open the API to third-parties we would need a key-store for the various pub/priv keys to validate each client's tokens, and to limit the risk if some nefarious party stole the encryption key.</p>
  
  <p>I feel this is a good implementation relying on asymmetric encryption and SSL/TLS. However are there potential security risks I've missed?</p>