Resource Indicators (RFC 8707) & Protected Resource Metadata
When clients call more than one API, a broad access token audience is risky: a token meant for one API can be reused against another if audience checks are loose.
When clients call more than one API, a broad access token audience is risky: a token meant for one API can be reused against another if audience checks are loose.