Client authentication and access token ownership validation

A method of performing validation of an access token under OAuth 2.0 protocol includes: providing, by an authorization server, the access token for service to a client in response to a request for the access token; adding, by the client, a client signature to at least the access token; forwarding, by the client, the access token as part of a service request to a resource server; and validating, by the resource server, whether the client is a valid owner of the access token, wherein the validation is based on at least the client signature of the access token. The validation is based on a hash of a combination of the service request, the access token and a shared secret key common to the client and the resource server, the output of which hash is added to the service request, and the resource server validates the hash.