RFC 7662 — Token Introspection

Specification: RFC 7662

Token Introspection allows resource servers to query the authorization server about the state and metadata of an access or refresh token.

Endpoint

• POST /introspect endpoint (Section 2)
• application/x-www-form-urlencoded request body

Token Types

• Access token introspection (JWT format)
• Refresh token introspection (opaque)
• Token type auto-detected by format

Client Authentication

• Client authentication required (Section 2.1)
• client_secret_basic supported
• client_secret_post supported

Response Fields (Section 2.2)

• active — whether the token is currently valid
• scope — space-delimited list of authorized scopes
• client_id — client that requested the token
• username — human-readable identifier of the resource owner
• token_type — type of the token (Bearer)
• exp — token expiration time (Unix timestamp)
• iat — time the token was issued (Unix timestamp)
• nbf — time before which the token is not valid
• sub — subject (user identifier)
• aud — intended audience
• iss — issuer identifier
• jti — unique JWT identifier
• token_type_hint parameter — optional per RFC; accepted, type auto-detected by format

Security Headers

• Cache-Control: no-store on every response (Section 2.2)
• Pragma: no-cache on every response
• {"active": false} returned for expired, revoked, or unknown tokens