title: How to differentiate JWT access token from refresh token used as Authorization header
body: <p>How can you determine if the JWT token used in Authorization: Bearer ... is an access token or a refresh token. In other words what prevents the user from using his JWT refresh token in the Authorization header instead of the acces token.</p>
  
  <p>When I look at the payload of both the access token and the refresh token in this guide section <a href="https://github.com/starkandwayne/ultimate-guide-to-uaa/blob/master/docs/refresh-tokens.md#jwt-refresh-tokens" rel="nofollow noreferrer">https://github.com/starkandwayne/ultimate-guide-to-uaa/blob/master/docs/refresh-tokens.md#jwt-refresh-tokens</a> I don't see any real way to identify which one is which.</p>
  
  <p>Refresh token:</p>
  
  <pre><code>{
  "jti": "3e53955fcff6429a8a187c4c37f1b592-r",
  "sub": "48a8d464-12dd-4b14-b7a0-96af58379ffb",
  "scope": [
      "openid",
      "airports.all"
  ],
  "client_id": "airports",
  "cid": "airports",
  "user_id": "48a8d464-12dd-4b14-b7a0-96af58379ffb",
  "origin": "uaa",
  "grant_type": "password",
  "user_name": "airports-all",
  "rev_sig": "4c3b3810",
  "iat": 1530739971,
  "exp": 1533331970,
  "iss": "https://192.168.50.6:8443/oauth/token",
  "zid": "uaa",
  "aud": [
      "openid",
      "airports"
  ]
  }
  </code></pre>
  
  <p>Access token:</p>
  
  <pre><code>{
  "jti": "fe39323464d74fb5a6fcb71d89f722c4",
  "sub": "48a8d464-12dd-4b14-b7a0-96af58379ffb",
  "scope": [
      "openid",
      "airports.all"
  ],
  "client_id": "airports",
  "cid": "airports",
  "azp": "airports",
  "user_id": "48a8d464-12dd-4b14-b7a0-96af58379ffb",
  "origin": "uaa",
  "grant_type": "password",
  "user_name": "airports-all",
  "email": "airports-all@example.com",
  "auth_time": 1530739970,
  "rev_sig": "4c3b3810",
  "iat": 1530739971,
  "exp": 1530783171,
  "iss": "https://192.168.50.6:8443/oauth/token",
  "zid": "uaa",
  "aud": [
      "openid",
      "airports"
  ]
  }
  </code></pre>
  
  <p>What is the standard? Put a different scope?</p>