title: Client bound access token
body: <p>Looking at the Oauth2 specification, it says in <a href="https://www.rfc-editor.org/rfc/rfc6749#page-46" rel="nofollow noreferrer">section 6</a>:</p>
  <pre><code>... the refresh token is bound to the client to which it was issued.
  </code></pre>
  <p>However, I can't find anything in the specification the explicitly states that the token should be bound to the requesting client also. I am assuming this to be the case, and the <a href="https://www.rfc-editor.org/rfc/rfc7662" rel="nofollow noreferrer">Introspection Extension</a> seems to support that assumption, but I want to know if that is correct.</p>
  <p>As an example, say I am using two applications that use Google as the Oauth2 Authorization Server. I'm assuming that Google will issue two different tokens, one to each application, and that the tokens can only be used by the client to which they were issued because they are bound to that client.</p>