Authenticate Access Token (Local) - Stytch Docs

Examine and introspect an access token locally.

All standard and custom claims will be returned. No network calls are made when invoking this API method. An error will be thrown if the token is not active. This method supports only access tokens. If an authorization_check object is passed in, this method will also check if the token contains scopes that are authorized to perform the specified action on the resource_id in the specified Organization.

Body

token

• type: string
• required
  The token to introspect.

authorization_check

• type: object
  If an authorization_check object is passed in, this method will also check if the Member is authorized to perform the given action on the given Resource in the specified Organization. A Member is authorized if their Member Session contains a Role, assigned explicitly or implicitly, with adequate permissions. In addition, the organization_id passed in the authorization check must match the Member's Organization.

Properties of authorization_check

organization_id

• type: string
  Globally unique UUID that identifies a specific Organization. The Organization's ID must match the Member's Organization.

resource_id

• type: string
  A unique identifier of the RBAC Resource, provided by the developer and intended to be human-readable. A resource_id is not allowed to start with stytch, which is a special prefix used for Stytch default Resources with reserved resource_ids.

action

• type: string
  An action to take on a Resource.

Response

scope

• type: string
  The scopes granted to the token.

token_type

• type: string
  The type of the token. Possible values are access_token and refresh_token.

expires_at

• type: string
  The expiration time of the token, expressed as a Unix timestamp.

issued_at

• type: string
  The time at which the token was issued, expressed as a Unix timestamp.

subject

• type: string
  The subject of the token. This is a unique identifier for the user.

issuer

• type: string
  The issuer of the token. This is the domain of your project.

audience

• type: array
  The audience (project_id) that the token is intended for.