anchor.diff:  }
   ----
   
  +.Kotlin
  +[source,kotlin,role="secondary"]
  +----
  +@Bean
  +fun jwtDecoder(): JwtDecoder {
  +    return NimbusJwtDecoder.withJwkSetUri(this.jwkSetUri)
  +            .jwsAlgorithms {
  +                it.add(RS512)
  +                it.add(ES512)
  +            }.build()
  +}
  +----
  +====
  +
   [[oauth2resourceserver-jwt-decoder-jwk-response]]
   ==== From JWK Set response
   
  
positive.code:     NimbusJwtDecoder jwtDecoder = NimbusJwtDecoder.withJwkSetUri(jwkSetUri).restOperations(rest).build();
      return jwtDecoder;
  }
  ```
  
  Also by default, Resource Server caches in-memory the authorization server's JWK set for 5 minutes, which you may want to adjust.
  Further, it doesn't take into account more sophisticated caching patterns like eviction or using a shared cache.
  
  To adjust the way in which Resource Server caches the JWK set, `NimbusJwtDecoder` accepts an instance of `Cache`:
  
  ```java
  @Bean
  public JwtDecoder jwtDecoder(CacheManager cacheManager) {
      return NimbusJwtDecoder.withJwkSetUri(jwkSetUri)
              .cache(cacheManager.getCache("jwks"))
              .build();
  }
  ```
  
  When given a `Cache`, Resource Server will use the JWK Set Uri as the key and the JWK Set JSON as the value.
  
  
negative.code: [[oauth2resourceserver-opaque-introspector]]
  For example, the second `@Bean` Spring Boot creates is an `OpaqueTokenIntrospector`, <<oauth2resourceserver-opaque-architecture-introspector,which decodes `String` tokens into validated instances of `OAuth2AuthenticatedPrincipal`>>:
  
  ====
  .Java
  [source,java,role="primary"]
  ----
  @Bean
  public OpaqueTokenIntrospector introspector() {
      return new NimbusOpaqueTokenIntrospector(introspectionUri, clientId, clientSecret);
  }
  ----
  
  .Kotlin
  [source,kotlin,role="secondary"]
  ----
  @Bean
  fun introspector(): OpaqueTokenIntrospector {
      return NimbusOpaqueTokenIntrospector(introspectionUri, clientId, clientSecret)
  }
  ----
  ====
  
  If the application doesn't expose a <<oauth2resourceserver-opaque-architecture-introspector,`OpaqueTokenIntrospector`>> bean, then Spring Boot will expose the above default one.
  
  