The usecase is very simple
I have a client app SPA in Angular(APTTUS eCommerce) using Salesforce Login for User SignIn.
I need to call a backend API(custom c# application) from the SPA to fetch data and show it to the user. I can pass the salesforce access token to the backend API.
QQ: How can the backend API validate the access token generated by salesforce? Is there a Key or Certificate or URL salesforce provides for me to validate the token in c# app and return data?
(Other Q: What claims does salesforce access token have vs Salesforce Identity token)