title: How to validate an OAuth 2.0 access token for a resource server?
body: <p>When a client asks a resource server to get a protected resource with an OAuth 2.0 access token, how does this server validate the token? The OAuth 2.0 refresh token protocol?</p>