title: DRF and Oauth2: creating resource and authorization servers
body: <p>I have developed a blog like project on the django rest framework and oauth2. I am now trying to separate the resource and authentication servers as shown here: <a href="https://django-oauth-toolkit.readthedocs.io/en/latest/resource_server.html" rel="nofollow noreferrer">https://django-oauth-toolkit.readthedocs.io/en/latest/resource_server.html</a></p>
  <p>I have taken the following steps:</p>
  <ol>
  <li>set up the auth server as described in the docs</li>
  <li>added the below to settings.py in the auth server</li>
  </ol>
  <pre><code>OAUTH2_PROVIDER = {
      'SCOPES': {'users': 'user details', 'read': 'Read scope', 'write': 'Write scope', 'groups': 'Access to your groups', 'introspection': 'introspection'},
      'ACCESS_TOKEN_EXPIRE_SECONDS': 86400,  # 1 Day.
  }
  </code></pre>
  <ol start="3">
  <li>set up the resource server as described in the docs</li>
  <li>added this to settings.py in the resource server:</li>
  </ol>
  <pre><code>OAUTH2_PROVIDER = {
  'RESOURCE_SERVER_INTROSPECTION_URL': 'http://localhost/o/introspect/',
  'RESOURCE_SERVER_AUTH_TOKEN': 'abc',
  }
  </code></pre>
  <p>I created the <code>RESOURCE_SERVER_AUTH_TOKEN based</code> on instructions here: <a href="https://stackoverflow.com/questions/47587486/django-oauth-separate-resource-and-authorization-server">Django OAuth- Separate Resource and Authorization Server</a></p>
  <p>To summarise, I created a superuser for the resource server then added an application to the resource server using the admin site, choosing <code>confidential</code> for <code>client type</code> and <code>authorization code</code> for <code>authorization grant type</code>. 'abc' was the random string I chose for the access token.</p>
  <p>Nevertheless, I am still facing the following error:</p>
  <pre><code>Introspection: Failed to get a valid response from the authentication server. Status code: 403, Reason: Forbidden.
  NoneType: None
  </code></pre>
  <p>Do you have any idea of where I may be going wrong from what I've described? Have I understood <a href="https://stackoverflow.com/questions/47587486/django-oauth-separate-resource-and-authorization-server">this</a> correctly and created the <code>RESOURCE_SERVER_AUTH_TOKEN</code> in the correct manner?</p>