Token Introspection

Validates a Bearer token and returns its claims, as specified by RFC 7662. Resource Servers call this endpoint on each incoming request to verify token validity.

Authentication required: the Resource Server must authenticate as a confidential OAuth client using HTTP Basic auth or body params.

Caching recommendation: cache active: true responses for at most 60 seconds per token. Never cache active: false responses.

curl -X POST "https://api.whatalo.com/oauth/introspect" \  -H "Content-Type: application/x-www-form-urlencoded" \  -d 'token=DlcGJFC7UmSx2fYKj7Bg3jhT9QgpyIzNcx7OGAoFu8U'

{
  "active": true,
  "scope": "read:products read:orders",
  "client_id": "abc123def456ghi789jkl012",
  "sub": "usr_7f3a9b2c1d4e5f6a",
  "exp": 1777719020,
  "iat": 1777715420,
  "token_type": "Bearer",
  "aud": "https://api.whatalo.com",
  "iss": "https://app.whatalo.com",
  "whatalo_store_id": "str_8k2m4n6p"
}

{
  "error": "invalid_client",
  "error_description": "Client authentication failed"
}