anchor.diff:  }
   ----
   
  +.Kotlin
  +[source,kotlin,role="secondary"]
  +----
  +class AudienceValidator : OAuth2TokenValidator<Jwt> {
  +    var error: OAuth2Error = OAuth2Error("invalid_token", "The required audience is missing", null)
  +    override fun validate(jwt: Jwt): OAuth2TokenValidatorResult {
  +        return if (jwt.audience.contains("messaging")) {
  +            OAuth2TokenValidatorResult.success()
  +        } else {
  +            OAuth2TokenValidatorResult.failure(error)
  +        }
  +    }
  +}
  +----
  +====
  +
   Then, to add into a resource server, it's a matter of specifying the `ReactiveJwtDecoder` instance:
   
  -[source,java]
  +====
  +.Java
  +[source,java,role="primary"]
   ----
   @Bean
   ReactiveJwtDecoder jwtDecoder() {
  
positive.code: }
  ----
  
  When the above `WebClient` is used to perform requests, Spring Security will look up the current `Authentication` and extract any `{security-api-url}org/springframework/security/oauth2/core/AbstractOAuth2Token.html[AbstractOAuth2Token]` credential.
  Then, it will propagate that token in the `Authorization` header.
  
  For example:
  
  [source,java]
  ----
  this.rest.get()
          .uri("https://other-service.example.com/endpoint")
  
negative.code: 
  And then autowire the value:
  
  ====
  .Java
  [source,java,role="primary"]
  ----
  @Value("${key.location}")
  RSAPublicKey key;
  ----
  
  .Kotlin
  [source,kotlin,role="secondary"]
  ----
  @Value("\${key.location}")
  val key: RSAPublicKey? = null
  ----
  ====
  
  [[webflux-oauth2resourceserver-jwt-decoder-public-key-builder]]
  ==== Using a Builder
  
  To wire an `RSAPublicKey` directly, you can simply use the appropriate `NimbusReactiveJwtDecoder` builder, like so:
  
  ====
  .Java
  [source,java,role="primary"]
  ----
  @Bean
  public ReactiveJwtDecoder jwtDecoder() {
      return NimbusReactiveJwtDecoder.withPublicKey(this.key).build();
  }
  ----
  
  .Kotlin
  [source,kotlin,role="secondary"]
  ----
  @Bean
  fun jwtDecoder(): ReactiveJwtDecoder {
      return NimbusReactiveJwtDecoder.withPublicKey(key).build()
  }
  ----
  ====
  
  [[webflux-oauth2resourceserver-jwt-decoder-secret-key]]
  === Trusting a Single Symmetric Key
  