Token introspection (RFC 7662)
OAuth
Token introspection (RFC 7662)
Returns whether a token is currently active and, if so, its metadata.
The caller authenticates as the client that owns the token: public
clients present client_id alone (PKCE model), confidential clients
must also present client_secret. A token that is unknown, expired,
revoked, rotated, or owned by a different client returns
{ "active": false } (never an error). Access tokens (JWT) and opaque
refresh tokens are both supported.
POST
Token introspection (RFC 7662)
Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Body
application/x-www-form-urlencoded

