view release on metacpan or  search on metacpan

examples/README.md  view on Meta::CPAN

# OAuth2 resource-server example

A minimal Catalyst app that protects a single endpoint, `/api/whoami`, with
`Catalyst::Plugin::OAuth2::ResourceServer`. The client is self-contained: it
mints its own demo bearer token with `Crypt::JWT` (HS256, using the same
signing key configured in the app), so no separate authorization server is
needed to try this out.

It calls `/api/whoami` three times to show the three outcomes the resource
server distinguishes:

1. **valid token**, a JWT signed with the app's `signing_key`. Verified and
   accepted: `200` with the resolved subject and scopes.
2. **wrong token**, the same claims but signed with a *different* key, so its
   HS256 signature fails to verify. Rejected: `401` with body
   `{"error":"invalid_token"}`.
3. **no token**, no `Authorization` header at all. Rejected with a bare `401`
   (no error body), which is distinct from the bad-signature case above.

## Run it

```
plackup -p 5000 examples/app.psgi
perl examples/client.pl            # or: perl examples/client.pl http://127.0.0.1:5000
```

## Expected output

```
valid token    -> HTTP 200 {"scopes":["example:read"],"subject":"demo-user"}
wrong token    -> HTTP 401 {"error":"invalid_token"}
no token       -> HTTP 401 {}
```