oauth.net
Token Introspection
Token Introspection lets a resource server query the authorization server to check whether an access token is active and to retrieve metadata about it — who it was issued to, what scopes it has, and when it expires.
When to use this
Use Token Introspection when your resource server receives opaque access tokens that it can't validate locally. If you use JWT access tokens, you can often validate them locally without a network call. Introspection adds a network round-trip per request but enables immediate revocation — a revoked token will show as inactive on the next introspection call.
The resource server POSTs the token to the introspection endpoint and receives a JSON response. The most important field is active: if false, the token should be rejected regardless of other fields. Active tokens also include scope, sub, exp, and other standard claims.
Related specs
- Bearer Tokens RFC 6750
- JWT Profile for Access Tokens RFC 9068 — local validation alternative
- Token Revocation RFC 7009
More resources
- Token Introspection Endpoint (oauth.com)