Token Introspection

When a resource server receives a bearer token (see that entry), it needs to know whether that token is actually still good, not expired, not revoked, and issued with whatever scope the request needs. If the token is a self-contained JWT, the resource server can often check that itself by verifying the signature locally (see JWT, JWKS). But opaque tokens, random strings with no embedded, verifiable claims, can't be checked that way; the resource server has no choice but to ask the authorization server directly, "is this token still valid, and what does it grant?" Token Introspection standardizes exactly that question and answer.

The shape is simple: the resource server POSTs the token in question to a dedicated /introspect endpoint; the authorization server responds with a JSON object whose most important field is active, true or false, plus, when active, metadata like scope, expiry, and the subject the token was issued for. A revoked, expired, or entirely fabricated token gets a flat {"active": false}, with no further detail leaked about why, the spec deliberately keeps the response minimal to avoid handing an attacker probing with guessed tokens any useful signal.

Where it comes from

RFC 7662 was published by the IETF OAuth Working Group in October 2015, with Justin Richer as its sole listed editor. Richer has been one of the more visible figures in practical OAuth tooling for years, beyond just this document: the MITREid Connect reference server and the book "OAuth 2 in Action" (co-authored with Antonio Sanso) are both his work. Solidus designed none of the introspection protocol itself.

Solidus today

auth.solidus.network runs a live POST /introspect endpoint, advertised in its discovery document (introspection_endpoint), that returns {"active": false} for any invalid, expired, or unrecognized token, checkable by anyone with curl and no account, right now. It correctly reports active: true with token metadata for genuinely valid tokens issued by the same server. This runs on Solidus's public testnet, has not been through an independent security audit, and, as of today, has no mainnet identity behind any token it could introspect.

See also

OAuth 2.0 is the framework this endpoint belongs to. Bearer Token is the opaque credential type introspection exists to check. Refresh Token can also be introspected through the same endpoint.