Token Introspection

OAuth 2.0 Token Introspection (RFC 7662, Proposed Standard, October 2015) defines an endpoint where a resource server sends a token to the authorization server and gets back whether it is active plus its scopes, client, subject, audience, and expiry.

Introspection is the alternative to self-contained JWT access tokens (RFC 9068). A resource server that introspects learns about revocation immediately, because the authorization server answers from live state, while one that only validates a JWT signature keeps accepting a revoked token until it expires. The trade-off is a network call per request (usually cached for seconds) and an availability dependency on the authorization server. Many deployments use opaque tokens for external clients and introspect at the gateway, then pass a short-lived internal token downstream. The endpoint itself must require resource server authentication, or it becomes an oracle for anyone holding a stolen token.

See also: access token, bearer token, JWT, authorization server, transaction tokens, token theft