Skip to main content

OAuth 2.0 Token Introspection

The Token Introspection extension defines a mechanism for resource servers to obtain information about access tokens. With this spec, resource servers can check the validity of access tokens, and find out other information such as which user and which scopes are associated with the token.

warning

Token Introspection is meant for first-party / internal use only. The endpoint should not be exposed publicly.

You can find more details on this endpoint in the Ory Hydra API Docs. You can also use the CLI command hydra token introspect <token>.

Another helpful resource is Token Introspection Endpoint.

Examples​

NodeJS​

const token = 'the access token'
const body = qs.stringify({ token })

fetch('http://<ory-hydra-admin-api>/oauth2/introspect', {
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
      'Content-Length': body.length
    },
    method: 'POST', body
}).then(body => {
    if (!body.active) {
        // Token is not active/valid
    }

    // token is active
})

Where <ory-hydra-admin-api> implies http://localhost:4445 if deployed locally.

CURL​

$ curl -X POST \
    -d 'token=<the-token>' \
    http://localhost:4445/oauth2/introspect