anchor.diff:  We have two main choices for our use case when authenticating on the identity provider (via Auth0): 
   
   * get an access token; this token is given to the API through the Authorization header, and the resource server must call the authorization server (auth0) to validate it and get further details (such as the user profile)
  -* get an id token using openid connect, this token being a (signed) https://tools.ietf.org/html/rfc7519[Json Web Token]; in this case, the resource server just have to know the secret key to decode the token, and is totally agnostic of the authorization server, because it can contain all the details you need by requiring the matching scopes (e.g. openid, email, name, roles, ...). For more, see https://auth0.com/docs/auth-api[the auth API doc].
  +* get an id token using openid connect, this token being a (signed) https://tools.ietf.org/html/rfc7519[Json Web Token]; in this case, the resource server just have to know the secret key to decode the token, and is totally agnostic of the authorization server, because it can contain all the details you need by requiring the matching scopes (e.g. openid, email, name, roles, ...). For more, see https://auth0.com/docs/auth-api[the authentication API doc].
   
   For our case, let's use JWT.
   
  
positive.code: 
  .The final word
  
  Done. You now have an API which is totally agnostic of the identity provider, and protected. You can now register users using Facebook or Google+ as identity providers (at the time of writing, the free plan limits to 2 the number of identity providers).
  
  
  
negative.code: -------
  https://gist.githubusercontent.com/cdelmas/dcb45c703a25249147fe/raw/78155e103a0dcaa0714ac1d5e6109482489edba5/Main.java[source]
  
  The `JWTAuthHandler` will parse the Authorization header, extract the token, and pass it to a `AuthProvider`. So next, you have to provide that `AuthProvider`, to parse the token and extract authorizations:
  
  [source,java]
  -------
  