Token introspection (RFC 7662) | Crehana Developers

Returns metadata about a token. Accepts application/x-www-form-urlencoded. Invalid/expired/revoked tokens return 200 with active=false (not an HTTP error).

Authentication

Api-Keystring

API key of the organization. Always sent together with the Secret-Access header.

Request

This endpoint expects an object.

tokenstringRequired

token_type_hintenumOptional

An enumeration.

client_idstringOptional

client_secretstringOptional

Response

Successful Response

activeboolean

substringOptional

client_idstringOptional

scopestringOptional

expintegerOptional

audstringOptional

issstringOptional

jtistringOptional

token_typestringOptional

Errors

400

Bad Request Error

401

Unauthorized Error

422

Unprocessable Entity Error

$	curl -X POST https://qa.creha.co/api/v5/rest/auth/oauth2/introspect \
>	-H "Secret-Access: Secret-Access" \
>	-H "Api-Key: <apiKey>" \
>	-H "Content-Type: application/x-www-form-urlencoded" \
>	-d "token=string"

1	{
2	"active": true,
3	"sub": "42",
4	"client_id": "mcp-client",
5	"scope": "openid profile api-v5:read",
6	"exp": 1924905600,
7	"aud": "api-v5",
8	"iss": "https://crehana.com",
9	"jti": "a1b2c3",
10	"token_type": "Bearer"
11	}

Authentication

Headers

Request

Response

Errors