tokenintrospeksjon

Token introspection is a protocol in OAuth 2.0 for querying an authorization server about the state and metadata of an access token. A resource server calls an introspection endpoint to determine whether a token is active and to obtain related information. This approach is useful for opaque tokens or when central checks are preferred over local validation.

Defined in RFC 7662, the resource server typically sends a request to the introspection endpoint using HTTP POST with the token parameter, authenticated by client credentials or another trusted mechanism. The response is a JSON object that always includes an active flag. If active is true, it may provide details such as scope, client_id, username, token_type, and standard time claims like exp, iat, sub, as well as other fields such as iss and aud.

Introspection supports centralized revocation and policy checks in multi-service architectures, such as API gateways and microservices. It is especially relevant for opaque tokens; for JWTs that can be validated locally, introspection is optional or used mainly to verify revocation or additional attributes not present in the token.

Security considerations include protecting the introspection endpoint with TLS, authenticating callers, and applying least privilege. Rate limiting, auditing, and careful handling of returned data help reduce abuse and information leakage. Privacy concerns arise because the response may reveal personal data, so operators should minimize fields and cache responses where appropriate.