Token Introspection

Resource servers need to validate access tokens. Two approaches:

1. JWT tokens (self-contained):

• Resource server has the auth server's public key.
• Verifies signature, parses claims (sub, exp, scope).
• No round trip to auth server. Fast.
• Caveat: revocation is hard (token's exp must run out).

2. Opaque tokens (random strings):

• Resource server calls introspection endpoint (RFC 7662):

  POST /introspect
    token=<access_token>
    client_id=<rs_client_id>
    client_secret=<rs_secret>
  

• Auth server returns:

  {
    "active": true,
    "sub": "user123",
    "exp": 1700000000,
    "scope": "read:email"
  }
  

• Or {"active": false} if expired/revoked.

Trade-offs:

• JWT: scalable, no DB lookup; revocation is hard
• Opaque: revocation is easy; needs DB call per request

Some auth servers cache introspection results for a few seconds — partial benefit of both.

Stripe, GitHub use opaque tokens. Most B2B SaaS uses JWT.