Token Management — IdP API

Validates a token and returns its metadata (RFC 7662).

Use this endpoint to determine if an access token or refresh token is currently active and retrieve information about it. This is useful for:

• Resource servers validating access tokens before granting access
• Applications checking token validity without decoding the JWT
• Audit systems retrieving token metadata

Authorization

Clients can only introspect tokens they issued. If a client attempts to introspect a token issued to a different client, the response will indicate active: false without revealing that the token exists (per RFC 7662 security requirements).

Response

• active: true - Token is valid and can be used
• active: false - Token is invalid, expired, revoked, or the client is not authorized to introspect it

When active: true, the response includes token claims such as sub, scope, exp, iat, and custom claims.

Token Type Detection

If token_type_hint is not provided, the endpoint automatically detects the token type based on its claims. However, providing the hint can improve performance.

Specification: RFC 7662 - OAuth 2.0 Token Introspection

Revokes an access token or refresh token (RFC 7009).

Use this endpoint to invalidate tokens when:

• A user logs out
• A user revokes application access
• A token is suspected of being compromised
• Security policies require token invalidation

Revocation Behavior

Refresh tokens: Revocation invalidates the refresh token via the Session Manager. All future attempts to use the token will fail.

Access tokens: Revocation adds the token to a revocation list. The token remains technically valid until it expires, but API calls will fail validation. This approach balances security with performance for short-lived tokens.

Authorization

The client revoking the token must either:

• Be the client that originally requested the token
• Have user credentials with appropriate permissions

Response

Per RFC 7009, this endpoint always returns a success response (200 OK) regardless of whether the token was valid. This prevents token enumeration attacks.

Specification: RFC 7009 - OAuth 2.0 Token Revocation