Token introspection endpoint

POSThttps://merchant.shuttleglobal.com/introspect

Language

Credentials

Client IDClient secret

Remember on this device

Kept in this browser tab unless you tick Remember; don't on a shared computer. Use keys from a sandbox account to test without moving money.

Parameters

Body application/json

cURL request

curl --request POST \
  --url https://merchant.shuttleglobal.com/introspect \
  --header 'Authorization: Basic <base64 of CLIENT_ID:CLIENT_SECRET>' \
  --header 'Content-Type: application/json' \
  --data '{
  "token": "string"
}'

const url = 'https://merchant.shuttleglobal.com/introspect';
const options = {
  method: 'POST',
  headers: {
    Authorization: 'Basic <base64 of CLIENT_ID:CLIENT_SECRET>',
    'Content-Type': 'application/json'
  },
  body: '{"token":"string"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

import requests

url = "https://merchant.shuttleglobal.com/introspect"

payload = { "token": "string" }
headers = {
    "Authorization": "Basic <base64 of CLIENT_ID:CLIENT_SECRET>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.json())

<?php

$client = new \GuzzleHttp\Client();

$response = $client->request('POST', 'https://merchant.shuttleglobal.com/introspect', [
  'body' => '{
  "token": "string"
}',
  'headers' => [
    'Authorization' => 'Basic <base64 of CLIENT_ID:CLIENT_SECRET>',
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();

require 'uri'
require 'net/http'

url = URI("https://merchant.shuttleglobal.com/introspect")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Basic <base64 of CLIENT_ID:CLIENT_SECRET>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"token\": \"string\"\n}"

response = http.request(request)
puts response.read_body

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "https://merchant.shuttleglobal.com/introspect"

  payload := strings.NewReader("{\n  \"token\": \"string\"\n}")

  req, _ := http.NewRequest("POST", url, payload)

  req.Header.Add("Authorization", "Basic <base64 of CLIENT_ID:CLIENT_SECRET>")
  req.Header.Add("Content-Type", "application/json")

  res, _ := http.DefaultClient.Do(req)

  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))

}

Response

Token introspection response

{
  "active": true,
  "application": "string",
  "exp": 0,
  "iat": 0,
  "username": "string"
}

POST

/introspect

Authenticate your client in one of two ways:

In the request body, with the client_id and client_secret parameters, or
With HTTP Basic authentication, using your client_id as the username and your client_secret as the password

Use one method per request, not both. If you put client_id or client_secret in the body, put both there.

Provides information about a token’s current state and metadata. Used by resource servers to validate tokens and get additional information.

Note: This endpoint requires client authentication to prevent token scanning attacks.

Authorizations

clientAuth
None

Request Body^required

object

token

required

string

The string value of the token to introspect

token_type_hint

string · enum

Optional hint about the type of token being introspected

Allowed values: access_token refresh_token

client_id

string

Your client ID. Required unless you send it with HTTP Basic authentication.

client_secret

string

Your client secret. Required unless you send it with HTTP Basic authentication.

Responses

200

Token introspection response

application/json

object

active

required

boolean

Indicates if the token is currently active

application

string

Application the token was issued for

Pattern /^app_\d+_\d+$/

exp

integer

Timestamp when the token will expire

iat

integer

Timestamp when the token was issued

username

string

Client identifier the token is connected to, representing the instance

Pattern /^cl_\d+$/

400

Invalid request

401

Invalid client credentials

Was this page helpful?

Token introspection endpoint

Authorizations

Request Bodyrequired

Responses

200

400

401

Request Body^required