ENSign In
Referencia APIOAuthIntrospect

Token Introspection

Validates a Bearer token and returns its claims, as specified by RFC 7662. Resource Servers call this endpoint on each incoming request to verify token validity.

Authentication required: the Resource Server must authenticate as a confidential OAuth client using HTTP Basic auth or body params.

Caching recommendation: cache active: true responses for at most 60 seconds per token. Never cache active: false responses.

POST
/oauth/introspect

Authorization

BasicAuth

Request Body

application/x-www-form-urlencoded

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X POST "https://api.whatalo.com/oauth/introspect" \  -H "Content-Type: application/x-www-form-urlencoded" \  -d 'token=DlcGJFC7UmSx2fYKj7Bg3jhT9QgpyIzNcx7OGAoFu8U'
{
  "active": true,
  "scope": "read:products read:orders",
  "client_id": "0a1b2c3d4e5f60718293a4b5c6d7e8f9",
  "sub": "3b1e5c7a-9f2d-4a6b-8c0e-1d2f3a4b5c6d",
  "exp": 1777719020,
  "iat": 1777715420,
  "token_type": "Bearer",
  "aud": "https://api.whatalo.com",
  "iss": "https://app.whatalo.com",
  "whatalo_store_id": "A3-W2b9MxK7"
}
{
  "error": "invalid_client",
  "error_description": "Client authentication failed"
}