> ## Documentation Index
> Fetch the complete documentation index at: https://docs.msu.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Token Introspection

> Validate an Access Token and retrieve its metadata.

Validates an Access Token and returns its metadata. Returns `"active": false` for expired or invalid tokens.

## Header parameters

<ParamField header="Content-Type" type="string" required>
  Must be `application/x-www-form-urlencoded`.
</ParamField>

<ParamField header="Authorization" type="string" required>
  Client credentials encoded in Base64: `Basic base64({CLIENT_ID}:{CLIENT_SECRET})`.
</ParamField>

## Body parameters

<ParamField body="token" type="string" required>
  The Access Token to validate.
</ParamField>

<ParamField body="token_type_hint" type="string">
  Token type hint. Fixed value `access_token`.
</ParamField>

## Response

<ResponseField name="active" type="boolean">
  Whether the token is valid and active. Returns `false` for expired or invalid tokens.
</ResponseField>

<ResponseField name="client_id" type="string">
  Client ID the token was issued for.
</ResponseField>

<ResponseField name="exp" type="integer">
  Token expiration time (Unix timestamp).
</ResponseField>

<ResponseField name="iat" type="integer">
  Token issuance time (Unix timestamp).
</ResponseField>

<ResponseField name="iss" type="string">
  Token issuer.
</ResponseField>

<ResponseField name="jti" type="string">
  Unique token identifier.
</ResponseField>

<ResponseField name="scope" type="string">
  Granted permission scopes.
</ResponseField>

<ResponseField name="sub" type="string">
  Wallet address of the token subject.
</ResponseField>

<ResponseField name="token_type" type="string">
  Token type. Always `Bearer`.
</ResponseField>

<RequestExample>
  ```bash cURL theme={null}
  curl --request POST \
    --url 'https://oauth.msu.io/oauth/introspect' \
    --header 'Content-Type: application/x-www-form-urlencoded' \
    --header 'Authorization: Basic base64({CLIENT_ID}:{CLIENT_SECRET})' \
    --data 'token={ACCESS_TOKEN}&token_type_hint=access_token'
  ```

  ```javascript JavaScript theme={null}
  const response = await fetch('https://oauth.msu.io/oauth/introspect', {
    method: 'POST',
    headers: {
      'Content-Type': 'application/x-www-form-urlencoded',
      'Authorization': `Basic ${btoa('{CLIENT_ID}:{CLIENT_SECRET}')}`
    },
    body: new URLSearchParams({
      token: '{ACCESS_TOKEN}',
      token_type_hint: 'access_token'
    })
  });
  const data = await response.json();
  ```

  ```python Python theme={null}
  import requests
  import base64

  credentials = base64.b64encode(b'{CLIENT_ID}:{CLIENT_SECRET}').decode()

  response = requests.post(
    'https://oauth.msu.io/oauth/introspect',
    headers={
      'Content-Type': 'application/x-www-form-urlencoded',
      'Authorization': f'Basic {credentials}'
    },
    data={
      'token': '{ACCESS_TOKEN}',
      'token_type_hint': 'access_token'
    }
  )
  data = response.json()
  ```
</RequestExample>

<ResponseExample>
  ```json Valid Token theme={null}
  {
    "active": true,
    "client_id": "e5451c6e-7bc1-4ec3-bd9c-98c18a7d3290",
    "exp": 1781673359,
    "iat": 1781672759,
    "iss": "NEXPACE",
    "jti": "b8ddec65-3697-441c-a118-fa31a08ccb42",
    "scope": "enhancement",
    "sub": "0x1234567890AbcdEF1234567890aBcdef12345678",
    "token_type": "Bearer"
  }
  ```

  ```json Expired or Invalid Token theme={null}
  {
    "active": false
  }
  ```
</ResponseExample>