oauth2-server

Introspect Token

Token Introspection endpoint (RFC 7662).

Issue #157: MCP SDK compliance - Token Introspection.

The caller must authenticate as a confidential OAuth client, with HTTP Basic (client_secret_basic) or client_id + client_secret in the form (client_secret_post) (RFC 7662 §2.1, #1741). Anyone else, including a public client, gets 401 invalid_client. A client learns about its own tokens only: a token issued to another client, like an unknown, expired or revoked one, is {"active": false}.

Args: request: FastAPI request (Authorization header, caller IP logging) token: Access token to introspect client_id: Caller's client_id for client_secret_post client_secret: Caller's secret for client_secret_post

Returns: Token metadata if active and issued to the caller, else {"active": false}; a 401 error response when the caller is not an authenticated confidential client.

Example: POST /api/v1/oauth/introspect Authorization: Basic <base64(client_id:client_secret)> Content-Type: application/x-www-form-urlencoded

token=mcp_abc123...

Spec: RFC 7662 - OAuth 2.0 Token Introspection

post/api/v1/oauth/introspect

Request

  • Base URL: https://memory.kagura-ai.com (the document declares no server; this is the origin it was published from)
  • URL: https://memory.kagura-ai.com/api/v1/oauth/introspect
  • Auth: none declared

Response

Successful Response

activeboolean required
client_idstring nullable
scopestring nullable
expinteger nullable
iatinteger nullable
token_typestring nullable
audstring nullable

Changes

No recorded changes to this operation across all 2 revisions of this API.