Node.js › Authentication & Authorization (JWT, OAuth, Passport)

What is token introspection, and when is it needed instead of simply verifying a JWT's signature locally?

Advanced

Answer

Token introspection is a live call to the authorization server (via a defined OAuth endpoint) to ask 'is this token still valid, and what does it represent?' -- necessary for opaque tokens that aren't self-contained JWTs (and so can't be verified locally at all), and sometimes used even with JWTs when a resource server needs to check real-time revocation status that a JWT's own signature alone can't reflect, since a JWT's local verification only confirms it hasn't been tampered with, not that it hasn't been revoked since issuance.

const response = await fetch('https://auth-server.com/introspect', {
  method: 'POST',
  headers: { Authorization: `Basic ${clientCredentials}` },
  body: new URLSearchParams({ token: accessToken }),
});
const { active, sub, scope } = await response.json();
if (!active) return res.status(401).json({ error: 'Token revoked or expired' });

Real-world example A resource server handling highly sensitive financial data uses token introspection on every request despite the added latency, specifically because it needs to guarantee immediate revocation enforcement, which local JWT signature verification alone cannot provide.

Common follow-ups: What's the performance tradeoff of introspection (a network call per request) compared to local JWT verification?;How do short JWT expiration times partially reduce, but not eliminate, the need for introspection?

Security;HTTP & HTTPS Modules