title: How do identity server validate the token at API or when we use Authorize attribute?
body: <p>I am using Identity server 4 as identity provider.</p>
  
  <p>After getting the token for a successful login, we pass this token to the resource server.</p>
  
  <p>My question is how does the Identity Server provider at the resource server end validate the submitted token ? </p>
  
  <p>When I observed the traffic using fiddler I didn't see any request submitting the token to the provider to check.</p>
  
  <p>Which means Identity Server provider at the resource server end itself is validating the token ?</p>
  
  <p>Then why do we need to provide Authority when it is not checking against it?</p>
  
  <p>How does the identity server provider at resource end make sure it is issued by a valid token provider ?</p>