Sign in
oAuth2

Introspect OAuth2 Access and Refresh Tokens

The introspection endpoint allows to check if a token (both refresh and access) is active or not. An active token is neither expired nor revoked. If a token is active, additional information on the token will be included. You can set additional data for a token by setting session.access_token during the consent flow.

post/admin/oauth2/introspect

Response

introspectedOAuth2Token

activeboolean required

Active is a boolean indicator of whether or not the presented token is currently active. The specifics of a token's "active" state will vary depending on the implementation of the authorization server and the information it keeps about its tokens, but a "true" value return for the "active" property will generally indicate that a given token has been issued by this authorization server, has not been revoked by the resource owner, and is within its given time window of validity (e.g., after its issuance time and before its expiration time).

audstring[]

Audience contains a list of the token's intended audiences.

client_idstring

ID is a client identifier for the OAuth 2.0 client that requested this token.

expinteger

Expires at is an integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token will expire.

extobject

Extra is arbitrary data set by the session.

iatinteger

Issued at is an integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token was originally issued.

issstring

IssuerURL is a string representing the issuer of this token

nbfinteger

NotBefore is an integer timestamp, measured in the number of seconds since January 1 1970 UTC, indicating when this token is not to be used before.

obfuscated_subjectstring

ObfuscatedSubject is set when the subject identifier algorithm was set to "pairwise" during authorization. It is the sub value of the ID Token that was issued.

scopestring

Scope is a JSON string containing a space-separated list of scopes associated with this token.

substring

Subject of the token, as defined in JWT [RFC7519]. Usually a machine-readable identifier of the resource owner who authorized this token.

token_typestring

TokenType is the introspected token's type, typically Bearer.

token_usestring

TokenUse is the introspected token's use, for example access_token or refresh_token.

usernamestring

Username is a human-readable identifier for the resource owner who authorized this token.

Changes

Changed in 2 of the 51 revisions of this API.6

  • 3e5674bbe9973See the full diff
    • ○

      api operation id adminIntrospectOAuth2Token removed and replaced with introspectOAuth2Token

      api-operation-id-removed

    • ○

      api tag oAuth2 added

      api-tag-added

    • ○

      api tag v0alpha2 removed

      api-tag-removed

  • cec56a3dc7893See the full diff
    • ○

      api operation id introspectOAuth2Token removed and replaced with adminIntrospectOAuth2Token

      api-operation-id-removed

    • ○

      api tag v0alpha2 added

      api-tag-added

    • ○

      api tag oAuth2 removed

      api-tag-removed