Token introspection is an authorization-server endpoint that lets a resource server obtain details about an access token and verify its authenticity. It is especially useful for opaque tokens, which cannot be inspected like JWTs. section 10.6
Checking an opaque access token
A resource server receives an opaque access token and cannot determine its status or metadata locally. It calls the authorization server’s authenticated introspection endpoint, which returns additional token information. For a JWT, the same endpoint can confirm that its jti value is legitimate. section 10.6
Secure introspection requires two protections:
- Authenticate requests to prevent attackers from forging requests that could expose token data. section 10.6
- Return the introspection result inside a signed JWT so resource servers can verify the response. section 10.6
