Ask the issuer whether a token is active.
An opaque token does not reveal usable claims to the application programming interface (API). Token introspection lets an authorized API ask the authorization server whether that token is currently active.
Why this lesson?
An application programming interface (API) receives an opaque token. It asks the issuer whether the token is active and which permissions are attached to it.
Learning goal and prerequisites
Receive an opaque token
The application programming interface (API) receives an opaque access token, which is a token whose value does not reveal locally usable claims. Because the API cannot validate the token contents by itself, it sends the token to the authorization server’s introspection endpoint over an authenticated connection.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
Not every access token contains claims that an application programming interface (API) can validate locally. Some tokens are opaque strings whose meaning is stored at the authorization server. Token introspection gives the API a standard way to ask the authorization server whether such a token is active and what properties it has.
The API sends the token to the introspection endpoint over an authenticated, protected connection. The authorization server checks the token’s current state and returns information such as whether it is active, which client or subject it represents, its scope, audience, and expiration.
This is useful when the resource server needs near-current token state or when the token format is intentionally opaque. Revocation can take effect as soon as the authorization server reports the token inactive, without waiting for a locally validated signed token to expire.
The tradeoff is dependency on the introspection service. The API now needs a network call or a carefully designed cache, and the introspection endpoint itself must be protected from unauthorized queries. Introspection answers whether a token is currently usable; the API still makes the final authorization decision for the requested resource and action.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.