<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>In the Messages document:</div><br><blockquote type="cite"><span class="Apple-style-span" style="font-family: verdana, charcoal, helvetica, arial, sans-serif; font-size: small; "><p style="margin-left: 2em; margin-right: 2em; ">This specification further constrains that only <a class="info" href="http://openid.net/specs/openid-connect-messages-1_0.html#OAuth.2.0.Bearer" style="font-weight: bold; position: relative; z-index: 24; text-decoration: none; color: rgb(153, 0, 0); background-color: transparent; ">Bearer Tokens</a> [OAuth.2.0.Bearer] are issued at the Token endpoint. The OAuth 2.0 response parameter "<tt style="color: rgb(0, 51, 102); font-family: 'Courier New', Courier, monospace; font-size: small; ">token_type</tt>" MUST be set to "<tt style="color: rgb(0, 51, 102); font-family: 'Courier New', Courier, monospace; font-size: small; ">Bearer</tt>".</p></span></blockquote><div><br></div><div>First, I would say that even if I think it is OK to use bearer tokens, I would strongly advise to not restrict the types of tokens to this particular type for all future use. Bearer is criticized a lot [1].</div><div><br></div><div>Second, if you restrict the type of token to bearer, you can save the effort of defining the JWT token type in the 'Standards' document.</div><div><br></div>[1]: <a href="http://hueniverse.com/2010/09/oauth-2-0-without-signatures-is-bad-for-the-web/">http://hueniverse.com/2010/09/oauth-2-0-without-signatures-is-bad-for-the-web/</a><br><div><br></div><div><br></div><div>Also, the example in sect 6.1 uses access_token, while I think it should be bearer_token.</div><div><br></div></body></html>