---
title: "POST /v1/oauth/introspect"
method: POST
path: "/v1/oauth/introspect"
tags: ["oauth"]
---

# POST /v1/oauth/introspect

`POST /v1/oauth/introspect`

Introspect an access token to see whether it is valid and active. You can also verify some token properties, such as its claims, scopes, and validity times.

Requests to this endpoint require authentication with your client ID and client secret, using _one_ of the following methods:

- **Basic access authentication** (Recommended): For [basic access authentication](https://en.wikipedia.org/wiki/Basic_access_authentication), the `{credentials}` string must be a Base64 encoded value of `{client id}:{client secret}`.
- **Body parameters**: Provide your integration's credentials using the `client_id` and `client_secret` body parameters.

This endpoint can't be called from a user's web-browser client because it uses client authentication with client secrets. Requests must come from your integration's backend, otherwise they'll be blocked by Canva's [Cross-Origin Resource Sharing (CORS)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS) policy.

## Response `200`

OK

- IntrospectTokenResponse — Introspection result of access or refresh tokens
  - `active` boolean, required — Whether the access token is active. If `true`, the access token is valid and active. If `false`, the access token is invalid.
  - `scope` string — The [scopes](https://www.canva.dev/docs/connect/appendix/scopes/) that the token has been granted.
  - `client` string — The ID of the client that requested the token.
  - `exp` integer — The expiration time of the token, as a [Unix timestamp](https://en.wikipedia.org/wiki/Unix_time) in seconds.
  - `iat` integer — When the token was issued, as a [Unix timestamp](https://en.wikipedia.org/wiki/Unix_time) in seconds.
  - `nbf` integer — The "not before" time of the token, which specifies the time before which the access token most not be accepted, as a [Unix timestamp](https://en.wikipedia.org/wiki/Unix_time) in seconds.
  - `jti` string — A unique ID for the access token.
  - `sub` string — The subject of the claim. This is the ID of the Canva user that the access token acts on behalf of. This is an obfuscated value, so a single user has a unique ID for each integration. If the same user authorizes another integration, their ID in that other integration is different.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `default` — Error Response

---

[API](https://skmtc.net/canva/apis/canva-connect-api.md) · [All operations](https://skmtc.net/canva/apis/canva-connect-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/canva/canva-connect-api/revisions/360bf0176ab2/schema)