IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Opaque tokens & introspection
Not every access token is a JWT that you can read. Some are opaque: a meaningless string. Your goal: explain how an API checks an opaque token, and when to choose one.
- A JWT carries its facts. An opaque token is only a handle.
- The API asks the issuer about an opaque token. This is introspection.
- If the answer says
active: false, the API refuses the token. - Opaque tokens cancel at once. JWTs are faster.
Two shapes of the same idea
A JWT access token is self-contained. The claims travel inside it. The API checks the signature and reads them on the spot. An opaque token is a reference. The real details stay at the issuer. The API cannot read it, so it must look it up.
| JWT (self-contained) | Opaque (reference) | |
|---|---|---|
| Who reads it | The API, on the spot | The issuer, when asked |
| Speed | Fast: no network call | One round trip per check |
| Cancel at once | Hard: valid until exp | Easy: switch it off at the source |
| Contents visible | Yes: anyone can decode it | No: it is only a random string |
Introspection: "is this still good?"
To use an opaque token, the API calls the issuer's introspection endpoint. The API sends the token. The issuer answers active: true or false. If it is active, the answer also holds scope, sub (the person) and exp. A scope is a permission. If active is false, the API stops there. The API must prove who it is when it asks, so a stranger cannot probe your tokens.
A railway PNR number. The number alone says nothing. Only the railway's system can say "seat confirmed" or "ticket canceled". Cancel it there, and the number is worthless. That is active: false. A JWT is more like a printed ticket with every detail on its face.
active: true. That costs one round trip, but the issuer has the last word.The trade-off, and the cache
JWTs are fast and work offline. But you cannot take one back, so a stolen JWT works until it expires. This is why the stolen-token defenses use short lifetimes. Opaque tokens can be canceled at once and hide their contents. But every check is a network call.
To cut that cost, APIs keep the answer in a cache for a few seconds. This wins back speed. But it reopens a small gap. A canceled token can still pass until its cache entry expires. Keep the TTL short and the gap stays small.
Which one do you pick?
🌐 Public API that must cancel now
Use opaque tokens with introspection. The issuer's live active: false is worth the round trip.
⚡ Internal calls with high traffic
Use JWTs with short lifetimes. Checking on the spot scales well. A short exp keeps the "cannot cancel" window small.
Many systems use both: fast JWTs between inside services, and opaque tokens at the public edge. That story began in getting a token.
Go deeper: the standards
Introspection is a standard from RFC 7662. A newer standard, RFC 9701, lets the issuer sign the answer as a JWT.
🧪 Interactive lab — enable JavaScript to play with this one.
See what a readable JWT shows to anyone who catches it, with ID Token Check. Then grade an issuer's revocation and logout habits with Logout Check.