A method for verifying authorization for a client to gain access to content and/or services, comprising: receiving, by an application server, a key request from the client, wherein the key request includes access information, session rights and authentication data generated by a third party server, wherein the client accesses services or content supplied by the third party server through the application server, and wherein the authentication data, TPAuth, includes a third party server service ticket, ST, issued by a key distribution center, KDC,, that the third party server previously received for the application server, which allows the client to access said services or content and authenticates that the generated session rights and authentication data are not generated by another entity than the third party server; extracting, by the application server, the access information, session rights and the authentication data from the key request; verifying, by the application server, the access information, the session rights and the authentication data, wherein the verifying further comprises: issuing, by the application server, a key reply directly to the client if the access information, the session rights and the authentication data are verified; receiving, by the key distribution center, KDC,, wherein the KDC is a separate entity from the application server, a client service ticket request from the client for the application server; issuing the client service ticket for the application server to the client, wherein the client service ticket for the application server is included in the key request from the client, and wherein the KDC generates the client service ticket for the application server. receiving, by an application server, a key request from the client, wherein the key request includes access information, session rights and authentication data generated by a third party server, wherein the client accesses services or content supplied by the third party server through the application server, and wherein the authentication data, TPAuth, includes a third party server service ticket, ST, issued by a key distribution center, KDC,, that the third party server previously received for the application server, which allows the client to access said services or content and authenticates that the generated session rights and authentication data are not generated by another entity than the third party server; extracting, by the application server, the access information, session rights and the authentication data from the key request; verifying, by the application server, the access information, the session rights and the authentication data, wherein the verifying further comprises: issuing, by the application server, a key reply directly to the client if the access information, the session rights and the authentication data are verified; receiving, by the key distribution center, KDC,, wherein the KDC is a separate entity from the application server, a client service ticket request from the client for the application server; issuing the client service ticket for the application server to the client, wherein the client service ticket for the application server is included in the key request from the client, and wherein the KDC generates the client service ticket for the application server. issuing, by the application server, a key reply directly to the client if the access information, the session rights and the authentication data are verified; receiving, by the key distribution center, KDC,, wherein the KDC is a separate entity from the application server, a client service ticket request from the client for the application server; issuing the client service ticket for the application server to the client, wherein the client service ticket for the application server is included in the key request from the client, and wherein the KDC generates the client service ticket for the application server.