---
schema_version: "1"
id: 3f18f479e9c588761f4a53575c2df285a91503b29376cc5f4249994d1bf3e8fd
title: Upgrade to Introspect Endpoint for Secure Token Management
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/commerce/264-0-0/account_manager_rn_upgrade_to_introspect_endpoint.md
canonical_url: https://help.salesforce.com/s/articleView?id=commerce.account_manager_rn_upgrade_to_introspect_endpoint.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 7ea883ef7e39aab7554a7e3fc89ff9d292839a9f5eec252bf26a99ed6d51bb7e
description: Salesforce strongly recommends that you replace the /tokeninfo endpoint with the /dwsso/oauth2/introspect endpoint. The /tokeninfo endpoint requires that the token is passed as a URL parameter. Sensitive information within URLs can be logged in various locations, including the user’s browser, the web server, and any forward or reverse proxy servers between the two endpoints. The /dwsso/oauth2/introspect endpoint includes the UUID access token in the request body which isn’t logged or recorded. In addition, only authenticated clients can use this endpoint. As an added level of security, an API client can only introspect its own tokens and can’t share information outside of your organizations.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Upgrade to Introspect Endpoint for Secure Token Management

Salesforce strongly recommends that you replace the `/tokeninfo` endpoint with the `/dwsso/oauth2/introspect` endpoint. The `/tokeninfo` endpoint requires that the token is passed as a URL parameter. Sensitive information within URLs can be logged in various locations, including the user’s browser, the web server, and any forward or reverse proxy servers between the two endpoints. The `/dwsso/oauth2/introspect` endpoint includes the UUID access token in the request body which isn’t logged or recorded. In addition, only authenticated clients can use this endpoint. As an added level of security, an API client can only introspect its own tokens and can’t share information outside of your organizations.

**When:** Beginning March 1, 2025, the /tokeninfo endpoint is deprecated and Salesforce ends support for the endpoint.

**How:** If you currently use the `/tokeninfo` endpoint, replace it with the `/dwsso/oauth2/introspect` (https://account.demandware.com/dwsso/oauth2/introspect) endpoint. This endpoint is specified in [RFC 7662](https://datatracker.ietf.org/doc/html/rfc7662), and provides a secure alternative. To learn more, see [Deprecation Notice for /tokeninfo and /dw/oauth2 endpoints for Commerce Cloud B2C platform's Account Manager](https://help.salesforce.com/s/articleView?id=000927357&type=1&language=en_US).