Failure handling

Is the API server’s client contained in the token aud (audience) claim? Hint: a client does not talk to itself, therefore the client itself will never be contained in the audience of its own tokens.

Is the token already expired?

Is the iss (issuer) claim correct? HTTP protocol and host should match the service’s configuration.

Does the related userinfo (either of the user or the service’s service principal) contain the required roles in the required format?