Skip to main content
When a valid access token is sent to Authlete’s /auth/introspection API, the response says the token is valid — and still carries Bearer error="invalid_request" as responseContent.
This is not a sign that anything went wrong. action: OK is the field that reports the outcome of the introspection: the access token exists and has not expired, and the resource server should serve the protected resource. responseContent is not a result — it is a prepared value for the WWW-Authenticate header, for the case where the resource server decides to reject the request anyway. Bearer error="invalid_request" is the simplest string usable with 400 Bad Request, and it is what Authlete returns when action is OK, because at that point the token is fine and the only thing left to complain about is the request itself.
In practice, tell the client what is actually wrong rather than sending this bare string — the developer of the client application cannot act on invalid_request alone. Note also that responseContent is formatted for the Bearer token type (RFC 6750). A service that uses a different token type has to build the error response itself. See also: