Skip to main content
POST
Introspect a token

Token introspection (RFC 7662)

Reports whether a token is currently active and returns its metadata (scope, expiry, subject). Send the token as a form field token (application/x-www-form-urlencoded). Returns { "active": false } for unknown, expired, or revoked tokens.

Body

application/json

RFC 7662. The calling client authenticates (client_id + secret for confidential). Form or JSON.

client_id
string
required
token
string
required
client_secret
string | null
token_type_hint
string | null

Response

Token metadata for a token this client issued, or { active: false }

active
boolean
required
client_id
string | null
exp
integer<int64> | null
iat
integer<int64> | null
scope
string | null
sub
string | null
token_type
string | null
username
string | null