mirror of
https://github.com/andwati/zitadel.git
synced 2026-10-25 08:42:16 +00:00
40 lines
2.3 KiB
Plaintext
40 lines
2.3 KiB
Plaintext
---
|
||
title: Token introspection
|
||
sidebar_label: Token introspection
|
||
description: Integrate OAuth 2.0 token introspection to verify access token validity in resource servers
|
||
---
|
||
|
||
import DocCardList from '@/components/docusaurus/doc-card-list';
|
||
|
||
Token introspection is the process of checking whether an access token is valid and can be used to access protected resources.
|
||
|
||
You have an API that acts as an OAuth resource server and can be accessed by user-facing applications.
|
||
To validate an access token by calling the ZITADEL introspection API, you can use the JSON Web Token (JWT) Profile (recommended) or Basic Authentication for token introspection.
|
||
It's crucial to understand that the API is entirely separate from the front end.
|
||
The API shouldn’t concern itself with the token type received.
|
||
Instead, it's about how the API chooses to call the introspection endpoint, either through JWT Profile or Basic Authentication.
|
||
Many APIs assume they might receive a JWT and attempt to verify it based on signature or expiration.
|
||
However, with ZITADEL, you can send either a JWT or an opaque Bearer token from the client end to the API.
|
||
This flexibility is one of ZITADEL's standout features.
|
||
|
||
## API application
|
||
|
||
If you have an API that behaves as an OAuth resource server that can be accessed by user-facing applications and need to validate an access token by calling the ZITADEL introspection API, you can use the following methods to register these APIs in ZITADEL:
|
||
|
||
- [JSON Web Token (JWT) Profile (Recommended)](/guides/integrate/token-introspection/private-key-jwt)
|
||
- [Basic Authentication](/guides/integrate/token-introspection/basic-auth)
|
||
|
||
## Service accounts
|
||
|
||
If there are client APIs or systems that need to access other protected APIs, these APIs or systems must be declared as [service accounts](/guides/manage/console/users-overview).
|
||
A service account is not considered an application type in ZITADEL.
|
||
Read the introduction on how to [authenticate service accounts](/guides/integrate/service-accounts/authenticate-service-accounts).
|
||
|
||
## Further references
|
||
|
||
- [Introspection API reference](/apis/openidoauth/endpoints#token-endpoint)
|
||
- [JWT vs. opaque tokens](/concepts/knowledge/opaque-tokens)
|
||
- [Python examples for securing an API and invoking it as a service account](https://github.com/zitadel/examples-api-access-and-token-introspection)
|
||
|
||
<DocCardList />
|