---
schema_version: "1"
id: f37783118aa35931ef1b8401c30ff8cfc13043b9eb12bb4e18ec4cac6166333b
title: OpenID Connect Token Introspection
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/xcloud/264-0-0/remoteaccess_oidc_token_introspection_endpoint.md
canonical_url: https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oidc_token_introspection_endpoint.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 60e05d8582201df0111278c1b62646ae0cc893dbbb932f9221ac625040c4e0ce
description: As part of the authorization process, token introspection allows all OAuth connected apps to check the current state of an OAuth 2.0 access or refresh token. The resource server or connected apps send the client app’s client ID and secret to the authorization server, initiating an OAuth authorization flow. As part of this flow, the authorization server validates, or introspects, the client app’s access token. If the access token is current and valid, the client app is granted access.
products:
  - Security
  - Cross Cloud
release: "264"
---
# OpenID Connect Token Introspection

As part of the authorization process, token introspection allows all OAuth connected apps to check the current state of an OAuth 2.0 access or refresh token. The resource server or connected apps send the client app’s client ID and secret to the authorization server, initiating an OAuth authorization flow. As part of this flow, the authorization server validates, or introspects, the client app’s access token. If the access token is current and valid, the client app is granted access.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small edition"><colgroup><col></colgroup><tbody><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: both Salesforce Classic and Lightning Experience</td></tr><tr class=""><td class="slds-cell-wrap" style="vertical-align:top;">Available in: <strong>All</strong> Editions</td></tr></tbody></table>

A connected app representing a client app sends a request to the Salesforce token introspection endpoint to validate its access token. The format of the token introspection endpoint URL is https://hostname/services/oauth2/introspect.

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note An OAuth client that directly registers OAuth 2.0 connected apps through the dynamic client registration endpoint can check the state of access and refresh tokens for itself and its registered connected apps. In addition, you can authorize a single connected app to introspect all access and refresh tokens throughout the entire org.

The requesting connected app can provide the `client_id` and `client_secret` in the Basic authorization request’s header or request’s body.

This example shows a request posted to the token introspection endpoint with the client credentials in the Basic authorization header.

```
POST /services/oauth2/introspect HTTP/1.1
Host: https://mycompany.my.salesforce.com
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Authorization: Basic M01WRzlsS2NQb05JTlZCSVBKamR3MUo5TExNODJIbkZWVlgxOUtZMQp1QTVtdTBRc
UVXaHFLcG9XM3N2RzNYSHJYRGlDUWpLMW1kZ0F2aENzY0E5R0U6MTk1NTI3OTkyNTY3NTI0MTU3MQ==

token=00DR00000009GVP!ARQAQE5XuPV7J4GoOu3wvLZjZI_TxoBpeZpRb6d8AVdII6cz
_BY_uu1PKxGeAjkSvO0LpWoL_qfbQWKlXoz1f2ICNiy.6Ndr&
token_type_hint=access_token
```

This example shows a request posted to the token introspection endpoint with the client credentials in the request’s body.

```
POST /services/oauth2/introspect HTTP/1.1
Host: https://mycompany.my.salesforce.com
Accept: application/json
Content-Type: application/x-www-form-urlencoded

token=00DR00000009GVP!ARQAQE5XuPV7J4GoOu3wvLZjZI_TxoBpeZpRb6d8AVdII6cz
_BY_uu1PKxGeAjkSvO0LpWoL_qfbQWKlXoz1f2ICNiy.6Ndr&client_id=3MVG9lKcPoNI
NVBIPJjdw1J9LLM82HnFVVX19KY1uA5mu0QqEWhqKpoW3svG3XHrXDiCQjK1mdgAvhCs
cA9GE&client_secret=1955279925675241571&token_type_hint=access_token
```

![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-xcloud-identity-264-0-0-production-enus/699dab6f-8f1a-4662-b24f-6521d5b747f7/images/icon_note.png)

Note If the `client_id` and `client_secret` are sent in the POST’s body, the authorization header is ignored.

Include the following parameters in the token introspection request. For information about the token introspection request, refer to section [2.1 Introspection Request](https://tools.ietf.org/html/rfc7662#section-2.1) in the Internet Engineering Task Force OAuth 2.0 Token Introspection document.

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small ">
      <colgroup>
        <col style="width:50%">
        <col style="width:50%">
      </colgroup>
      <thead class="slds-text-title_caps ">
        <tr class="">
          <th scope="col" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" id="d44483e115">Parameter</th>
          <th scope="col" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" id="d44483e118">Description</th>
        </tr>
      </thead>
      <tbody>
        <tr class="">
          <td data-label="Parameter" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d44483e115 ">
            <code>token</code>
          </td>

          <td data-label="Description" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d44483e118 ">The string value of the access token or refresh token returned from the token
            endpoint.</td>

        </tr>
        <tr class="">
          <td data-label="Parameter" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d44483e115 ">
            <code>token_type_hint</code>
          </td>

          <td data-label="Description" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d44483e118 ">
            <p>(Optional) A hint about the token type being queried in the request. There are
              two valid values.</p>
            <ul>
              <li>access_token</li>

              <li>refresh_token</li>

            </ul>
          </td>

        </tr>
        <tr class="">
          <td data-label="Parameter" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d44483e115 ">
            <code>child_sessions</code>
          </td>

          <td data-label="Description" class="slds-cell-wrap" style="text-align:left;vertical-align:top;" headers="d44483e118 ">
            <p>(Optional) The status of Content, Lightning, or VisualForce child sessions. Because
              this parameter increases the response length, we recommend that you only use it when you need
              information about child sessions. For example, use this parameter to identify why a child
              session fails to load.</p>
            <p>You can only include this parameter for introspection of active
              access tokens. It doesn’t work with introspection of refresh tokens.</p>
            <p>To include the
              parameter in your introspection request, enter <code>child_sessions=all</code>. Salesforce responds with a value for each type of child
              session:</p>
            <ul>
              <li><code>active</code>—The child session is active and has a valid
                access token.</li>
              <li><code>inactive</code>—The child session doesn’t have a current
                access token.</li>
              <li><code>missing</code>—A child session can’t be found.</li>
            </ul>
          </td>

        </tr>
      </tbody>
    </table>

#### See Also

- [OpenID Connect Dynamic Client Registration for External API Gateways](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oidc_dynamic_client_reg_flow.htm&release=264.0.0&type=5 "Although not a typical authorization flow, you can use OpenID Connect dynamic client registration to enable your Salesforce instance as an independent OAuth authorization server to protect resources hosted on an external API gateway.")
- [OAuth 2.0 Authorization Errors](https://help.salesforce.com/s/articleView?id=xcloud.remoteaccess_oauth_flow_errors.htm&release=264.0.0&type=5 "Errors can occur during OAuth authorization. For example, a user denies access to the connected app or request parameters are incorrect. When errors occur, the authorizing server sends an error to the callback URL with an error code.")