We are making an API call from our app to ISAM authentication policy inorder to perform MFA. Since its a server to server communication, we are securing it through oauth. The app is going to pass a bearer token when they make this API call. Is it best to write an authz rule to validate the bearer token or we can enable oauth-eas and use introspection config to validate the bearer token?

Note: This api call will be used for our forgot password scenario, so the user is not authenticated during the process.