Token Introspection

Verify and inspect OAuth tokens.

Introspect Token

curl -X POST http://localhost:8000/oauth/introspect \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "token=ACCESS_TOKEN" \
  -d "client_id=CLIENT_ID" \
  -d "client_secret=CLIENT_SECRET"

Response

{
  "active": true,
  "client_id": "CLIENT_ID",
  "username": "[email protected]",
  "scope": "openid profile email",
  "sub": "user:abc123",
  "aud": "CLIENT_ID",
  "iss": "http://localhost:8000",
  "exp": 1730000000,
  "iat": 1729996400,
  "token_type": "Bearer"
}

Inactive Token

{
  "active": false
}

Use Cases

• Resource servers verify tokens
• API gateways validate requests
• Monitoring track token usage
• Debugging inspect token claims