Methods and systems for controlling access to a protected resource

A network device, comprising:

• a communication interface connected to an external network;
• a memory;
• and
• a processor coupled to the communication interface and the memory, the processor being configured to:
• receive, via the communication interface from a client application executing on a first device, a first signal including a request to obtain an access token for accessing a protected resource, the request including:
• a client identifier uniquely identifying the client application;
• a user identifier uniquely identifying an end user of the client application;
• and
• a public key associated with the end user;
• validating the request to obtain the access token;
• in response to validating the request to obtain the access token, transmit via the communication interface to the client application on the first device, a second signal including an access token for accessing the protected resource;
• receive, via the communication interface from a web server associated with the protected resource, a third signal including a request to validate a bearer token submitted by the client application to the web server, the bearer token including a digital signature;
• validate the bearer token, the validating including verifying the digital signature using the public key;
• and
• in response to validating the bearer token, send to the web server via the communication interface a fourth signal including a notification that the bearer token is valid.