Tokens and credentials
Token introspection
An endpoint where a resource server asks the authorization server whether a token is active and what it grants.
What Token introspection means
Token introspection (RFC 7662) is an authorization server endpoint that a protected API calls with a token to learn whether it is currently active and, if so, its scope, client, subject and expiry. It is how APIs validate opaque tokens, and how they see revocation immediately rather than at expiry.
Defined in: RFC 7662 — OAuth 2.0 Token Introspection.
How it works
The API POSTs the token to the introspection endpoint, authenticating itself. The response always contains active; if true, it carries the token's metadata. If the token was revoked a second ago, active is false.
The cost is a network call per validation. Most deployments cache results for a short period, which reintroduces a small revocation delay in exchange for latency.
The mistake people actually make
Leaving the introspection endpoint callable without client authentication. It then acts as an oracle that tells anyone whether a token they found is still valid.
Related terms
Access token
A credential presented to an API to prove the caller is authorized, typically short-lived.
Token revocation
A standard endpoint that lets a client tell the authorization server a token is no longer needed and must stop working.
Session revocation
Ending an active session so that subsequent requests fail, rather than waiting for a token to expire.
Building on any of this?
Tell us what you're putting together. We'll tell you plainly whether Authreads fits it.