Why round trip to introspection point on each call?

Question

I am seeing for each protected API call, a call to the introspection endpoint of identity server. Can I stop this from happening?

We have a React application that uses implicit flow. When the application receives the access token it is then used to make calls to another Web API with the access token. What we noticed is the introspection endpoint is called on each call.

I thought JWT tokens do not need to be validated against the issuer each time a call is made.

I have the following app setup:

services.AddAuthentication("Bearer")
                .AddIdentityServerAuthentication(options =>
                {
                    options.Authority = identityServiceUri;
                    options.ApiName = "SMAppServices";
                    options.RequireHttpsMetadata = false;
                });

Answer 1

You have probably set the access token type to reference type. You can check this in the client configuration in the IdentityServer. There is a property called AccessTokenType in the Client class.