Secure stateless token authentication

Recently I once again came into the situation that I needed to authenticate and identify endusers without a local user database. I only rely on the Access Token returned by an OpenID Connect auth server. However, I also couldn’t disclose the token to the enduser, because that would enable them to do more things directly with the downstream API than I want to enable them to. What I tried first is…