title: Bearer token getting too big
body: <p>In an application I'm building, we're using JWT tokens as OAuth Bearer token.</p>
  
  <p>Say we have a resource collection called <code>things</code>, addressable by <code>thing</code> ID, eg. <code>things/1</code>, <code>things/44</code>, etc.</p>
  
  <p>Currently, whenever someone request an access token with the scope <code>things</code>, we include a list of all the rights the user has to each of the <code>things</code> it has rights to:</p>
  
  <pre><code>{
     "sub": "Romeo",
     "scope": [ "things" ],
     "things": {
       "1": [ "read", "write", "delete" ],
       "44": [ "read", "write"],
     }
    // ...
  }
  </code></pre>
  
  <p>This works fine, but things go bad when the user has a lot of <code>things</code>. Because all the rights are encoded inside the JWT token, the token gets really bigger for every <code>thing</code> the user has.</p>
  
  <p>This is not scalable, and I need to find a solution for this. I could scope the tokens to belong to a single <code>thing</code> at a time, but then token management for a client that manages becomes a hell (I need a token that can <em>list</em> the tokens and need to keep one token per <code>thing</code>).</p>
  
  <p>I can't get rid of Bearer tokens because some of our components are not able to talk to the token issuer for multiple reasons.</p>
  
  <p>Is there a standard way to solve this problem? I was thinking about making tokens with the <code>things</code> scope interchangeable, so I can exchange restricted tokens that only have a part of the <code>things</code> in them for other tokens that have other parts of the <code>things</code> in them.</p>