diff --git a/DigitalData.Core.Abstractions/Security/IAsymmetricTokenDescriptor.cs b/DigitalData.Core.Abstractions/Security/IAsymmetricTokenDescriptor.cs
index aabcf8a..e1f2242 100644
--- a/DigitalData.Core.Abstractions/Security/IAsymmetricTokenDescriptor.cs
+++ b/DigitalData.Core.Abstractions/Security/IAsymmetricTokenDescriptor.cs
@@ -7,6 +7,8 @@ namespace DigitalData.Core.Abstractions.Security
     /// </summary>
     public interface IAsymmetricTokenDescriptor : IAsymmetricPrivateKey, IUniqueSecurityContext
     {
+        IAsymmetricTokenValidator Validator { get; }
+
         string? ApiRoute { get; }
 
         #region SecurityTokenDescriptor Map
diff --git a/DigitalData.Core.Abstractions/Security/IAsymmetricTokenValidator.cs b/DigitalData.Core.Abstractions/Security/IAsymmetricTokenValidator.cs
new file mode 100644
index 0000000..453248b
--- /dev/null
+++ b/DigitalData.Core.Abstractions/Security/IAsymmetricTokenValidator.cs
@@ -0,0 +1,6 @@
+namespace DigitalData.Core.Abstractions.Security
+{
+    public interface IAsymmetricTokenValidator : IAsymmetricPublicKey
+    {
+    }
+}
\ No newline at end of file
diff --git a/DigitalData.Core.Security/RSAKey/RSAPrivateKey.cs b/DigitalData.Core.Security/RSAKey/RSAPrivateKey.cs
index c2bad6f..67d701a 100644
--- a/DigitalData.Core.Security/RSAKey/RSAPrivateKey.cs
+++ b/DigitalData.Core.Security/RSAKey/RSAPrivateKey.cs
@@ -1,5 +1,4 @@
 using DigitalData.Core.Abstractions.Security;
-using Microsoft.IdentityModel.Tokens;
 using System.Security.Cryptography;
 
 namespace DigitalData.Core.Security.RSAKey
@@ -24,16 +23,16 @@ namespace DigitalData.Core.Security.RSAKey
 
         public bool IsEncrypted { get; init; }
 
-        private readonly Lazy<IAsymmetricPublicKey> _lazyPublicKey;
+        protected TPublicKey CreatePublicKey<TPublicKey>() where TPublicKey : RSAPublicKey, new()
+            => new() { Content = RSA.ExportRSAPublicKeyPem() };
+
+        private readonly Lazy<RSAPublicKey> _lazyPublicKey;
 
         public IAsymmetricPublicKey PublicKey => _lazyPublicKey.Value;
 
         public RSAPrivateKey()
         {
-            _lazyPublicKey = new(() => new RSAPublicKey()
-            {
-                Content = RSA.ExportRSAPublicKeyPem()
-            });
+            _lazyPublicKey = new(CreatePublicKey<RSAPublicKey>);
         }
 
         internal void SetPem(string pem)
diff --git a/DigitalData.Core.Security/RSAKey/RSATokenDescriptor.cs b/DigitalData.Core.Security/RSAKey/RSATokenDescriptor.cs
index 5feed7c..a4ab6e7 100644
--- a/DigitalData.Core.Security/RSAKey/RSATokenDescriptor.cs
+++ b/DigitalData.Core.Security/RSAKey/RSATokenDescriptor.cs
@@ -10,6 +10,10 @@ namespace DigitalData.Core.Security.RSAKey
     {
         public string? ApiRoute { get; init; }
 
+        private readonly Lazy<RSATokenValidator> _lazyTokenValidator;
+
+        public IAsymmetricTokenValidator Validator => _lazyTokenValidator.Value;
+
         #region SecurityTokenDescriptor Map
         /// <summary>
         /// Gets or sets the value of the 'audience' claim.
@@ -102,6 +106,8 @@ namespace DigitalData.Core.Security.RSAKey
         public RSATokenDescriptor()
 #pragma warning restore CS8618 // Non-nullable field must contain a non-null value when exiting constructor. Consider declaring as nullable.
         {
+            _lazyTokenValidator = new(CreatePublicKey<RSATokenValidator>);
+
             _lazyRsaSecurityKey = new(() => new RsaSecurityKey(RSA));
 
             _lazySigningCredentials = new(() => SigningDigest is null
diff --git a/DigitalData.Core.Security/RSAKey/RSATokenValidator.cs b/DigitalData.Core.Security/RSAKey/RSATokenValidator.cs
new file mode 100644
index 0000000..7c3df27
--- /dev/null
+++ b/DigitalData.Core.Security/RSAKey/RSATokenValidator.cs
@@ -0,0 +1,8 @@
+using DigitalData.Core.Abstractions.Security;
+
+namespace DigitalData.Core.Security.RSAKey
+{
+    public class RSATokenValidator: RSAPublicKey, IAsymmetricTokenValidator
+    {
+    }
+}
\ No newline at end of file