# `Anubis.Server.Authorization.Validator`

Behaviour for token validators.

Implement this behaviour to plug in a custom token validation strategy.
Two built-in implementations are provided:

  * `Anubis.Server.Authorization.JWTValidator` — validates JWTs using JWKS (requires `:jose`)
  * `Anubis.Server.Authorization.IntrospectionValidator` — validates opaque tokens via RFC 7662

## Example

    defmodule MyApp.CustomValidator do
      @behaviour Anubis.Server.Authorization.Validator

      @impl true
      def validate_token(token, _config) do
        case MyApp.TokenStore.lookup(token) do
          {:ok, claims} -> {:ok, claims}
          :error -> {:error, :token_not_found}
        end
      end
    end

# `claims`

```elixir
@type claims() :: map()
```

# `config`

```elixir
@type config() :: Anubis.Server.Authorization.config()
```

# `reason`

```elixir
@type reason() :: atom() | String.t() | {atom(), term()}
```

# `token`

```elixir
@type token() :: String.t()
```

# `validate_token`

```elixir
@callback validate_token(token(), config()) :: {:ok, claims()} | {:error, reason()}
```

Validates a bearer token and returns normalized raw claims on success.

The returned map should contain string keys as received from the token source.
`Anubis.Server.Authorization.normalize_claims/1` is called by the authorization
layer to convert it to the canonical claims shape stored in `Context.auth`.

Returns `{:ok, raw_claims}` or `{:error, reason}`.

---

*Consult [api-reference.md](api-reference.md) for complete listing*