I have two doubts about the remote introspection. Hope someone can help.
1, I created two authorization servers in API gateway, one is for local and the other is for remote.
but they use the same okta authorization server.
I create two APIs and two applications in the API gateway. one application authentication uses the local introspection, the other application authentication uses the remote introspection.
But actually only local introspection can work. Remote introspection cannot work.
So how I make the remote introspection work? after my app is just SPA app with PKCE(no client secret), the remote introspection need the client secret, so what’s the value I should provide?
2, what about I replace the remote introspection endpoint of my own one? actually I want to provide my own service that receive the remote introspection request from API gateway and visit okta and return the final result. Is that possible?
Thanks & Regards,