tokenintrospection

Token introspection is a mechanism defined in OAuth 2.0 that allows a protected resource or another authorized party to query an authorization server about the status and metadata of an access or refresh token. The standard, RFC 7662, specifies an introspection endpoint that accepts a token and returns a JSON payload describing the token’s current state and attributes. The endpoint is typically protected to ensure that only trusted clients or resource servers can perform introspection.

A client or resource server sends a request to the introspection endpoint with the parameter token, and optionally token_type_hint if the type is known. The request must be authenticated; common methods include HTTP Basic with client credentials or client authentication using an access token. The response includes an active field. If active is false, the token is no longer valid. If true, the response may include standard claims such as scope, client_id, username, token_type, exp, iat, iss, sub, aud, and jti, along with any additional token-specific metadata. The exact set of claims is determined by the authorization server. This mechanism supports opaque tokens and can also be used with self-contained tokens to verify revocation status after issuance.

Security considerations emphasize that introspection endpoints disclose token metadata, so access should be tightly controlled and transport secured by TLS. Introspection can enable revocation and dynamic access decisions, but improper exposure risks privacy and leakage of user data. Related concepts include OAuth 2.0, JSON Web Tokens, token revocation (RFC 7009), and broader API security practices.