Client authentication can be provided either:

1. In the request body using client_id and client_secret parameters, or
2. Using HTTP Basic authentication with client_id as username and client_secret as password

If both are provided, Basic authentication takes precedence.

Original description: |
Provides information about a token's current state and metadata.
Used by resource servers to validate tokens and get additional information.

Note: This endpoint requires client authentication to prevent token scanning attacks.