Indicates whether the given token (access token or refresh token) is valid and active. Additionally, it provides details about the token.
This endpoint is authenticated by providing the WorkOS Application’s client ID and client secret in the body of the request.
An application can introspect the tokens issued to it. A first-party application can additionally introspect consent-backed OAuth access tokens issued to public clients in its environment, such as tokens held by third-party MCP clients that have no client secret of their own; the client_id in the response names the application the token was issued to. Tokens issued to confidential clients, M2M access tokens, and refresh tokens can only be introspected by the application they were issued to. Tokens from other environments and tokens issued to another application when the caller is not first-party are reported as active: false.
| curl -X POST https://authkit_domain/oauth2/introspection \ | |
| -d "client_id=client_01JP8BD0CZ401TDF9X54NT5ZEK" \ | |
| -d "client_secret=1eaaf7a47948398d89e2b07dce912b6a9c0282aa20e88c026fcb42fd6b06b73e" \ | |
| -d "token=eyJhbGciOiJSUzI1NiIsImtpZCI6InNzb19vaWRjX2tleV9wYWlyXzAxSlBYTjZLRjdOQUVBWlRGRFlFU0FFMEtYIn0.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzdWIiOiJ1c2VyXzAxSlBYTjZLQTc2MjJLSjRWUDgzWDFOVEtYIiwic2lkIjoiYXBwX2NvbnNlbnRfMDFKUFhONktBUVc4M0FNWFhZNVdYM1JIVEoiLCJqdGkiOiIwMUpQWE42S0ZHWlFZVzNBTTJERVZYODRZUyIsImV4cCI6MTc0MjYwNDg1MywiaWF0IjoxNzQyNjA0NTUzfQ.dsMI3PBp5LWGeUosFUYYLsjC78swFMI4EUVXW1LN7yd80hxLhAvCX6gKN2s9h13a1tkAX77PDI2PooEJ8RQyB-Zcp_wzdomHffjqCeL-YgGojuCUmgjOm9w7kwg86e81tcMBIX3y872pe9jg1HrVs0t_tJNjoLEKtSwm-Flegttyg7M5SikrHKzul0Jv6ovaXjN4RygDPH6Nbg7Ewag5UwYd9aQK7IRG2oXZPC6WjJx-boyRvwgAqJ5pCedRc2ta5-sb3KyrgS6Xb0S3y1KA57RiDvJdQp8z_wL2_4e6iwG00a7OwyorIDpxKl5kAJE_Fct71931lB4EmNsGkVLxoA" \ | |
| -d "token_type_hint=access_token" |
| { | |
| "active": true, | |
| "client_id": "client_01JP8BD0CZ401TDF9X54NT5ZEK", | |
| "iss": "https://authkit_domain", | |
| "aud": "client_123456789", | |
| "sub": "user_01JPXN6KA7622KJ4VP83X1NTKX", | |
| "org_id": "org_01HRDMC6CM357W30QMHMQ96Q0S", | |
| "sid": "app_consent_01JPXN6KAQW83AMXXY5WX3RHTJ", | |
| "jti": "01JPXN6KFGZQYW3AM2DEVX84YS", | |
| "exp": 1742604853, | |
| "iat": 1742604553, | |
| "token_type": "access_token" | |
| } |
| { | |
| "active": true, | |
| "aud": "client_123456789", | |
| "client_id": "client_01JP8BD0CZ401TDF9X54NT5ZEK", | |
| "iss": "https://authkit_domain", | |
| "sub": "client_01JP8BD0CZ401TDF9X54NT5ZEK", | |
| "org_id": "org_01JJT1ZX4Y9BG603K4Q9SHZ1KW", | |
| "jti": "01JPXN6KFGZQYW3AM2DEVX84YS", | |
| "exp": 1742604853, | |
| "iat": 1742604553, | |
| "token_type": "access_token" | |
| } |
| { | |
| "active": true, | |
| "client_id": "client_01JP8BD0CZ401TDF9X54NT5ZEK", | |
| "iss": "https://authkit_domain", | |
| "aud": "client_123456789", | |
| "sub": "user_01JPXN6KA7622KJ4VP83X1NTKX", | |
| "iat": 1742604553, | |
| "token_type": "refresh_token" | |
| } |
| { | |
| "active": false | |
| } |
POST