--- updatedAt: 2026-07-28T08:16:07.000Z --- Fetch the complete documentation index at: https://enterprise-docs.itigerup.com/llms.txt. Use this file to discover all available pages before exploring further. Append .md to any documentation page URL to get its markdown version. # Other ## Token Introspection As the issued Access Token is a JWT, the App can and should introspect the Access Token locally. However, the Introspection Endpoint can be used to check if a token has been revoked. In the request, `token` must be set to the token that the App wants to introspect. The App also needs to authenticate itself by one of the methods explained in Section [Authentication Method](#authentication-method). If the token has been revoked, the token is not issued to the App, or the token does not have the scopes in the request, an introspection response with the active field set to `false` and no further information will be returned. Otherwise, the token is active for the App, an introspection response with the active field set to `true` will be returned. The claims in the introspection response are exactly the same as those in the JWT payload, except `jti`. ## Token Revocation Once the App no longer needs the issued Access Token — *e.g.*, the user has logged out — the App should use the Revocation Endpoint to revoke the Access Token and Refresh Token. In the request, `token` must be set to the token that the App wants to get revoked. The App also needs to authenticate itself by one of the methods explained in Section [Authentication Method](#authentication-method). Note that, after a successful request, BOTH Access Token and Refresh Token will be revoked. ## Authentication Method When interacting with the Authorization Server, the App is required to include its credentials in the request at most endpoints to authenticate its identity. The Authorization Server supports two authentication methods as described below. After agreeing on a method in advance, the App can use the agreed-upon method for authentication. ### Secret Basic The App must include the `client_id` and `client_secret` provided during App registration in the HTTP Basic authorization header when sending requests, as per [Authorization - HTTP|MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Authorization#basic_authentication). ```http Authorization: Basic ``` ### Secret Post The App must include the `client_id` and `client_secret` provided during App registration in the request body via two additional parameters, `client_id` and `client_secret`.