Clerk API (unofficial showcase)
POST/oauth_applications/access_tokens/verify

Verify an OAuth access token

Verifies an OAuth access token and returns its token details or active status. Supply the token in access_token; the legacy secret field is deprecated. Use this endpoint to check whether an access token is active and retrieve its associated client, subject, and scopes when available.

  • IdempotentThe SDK sends Idempotency-Key, so a retried request is only applied once.

2 body fields

OAuth access token value to verify.

access_tokenstringoptional
The access token to verify.
secretstringdeprecatedoptional
The access token to verify. This is deprecated, use `access_token` instead.

3 status codes
200Returns either the OAuth access token details, including its client, subject, scopes, and status, or an `active` boolean indicating the token's status.
objectstringrequired
Allowed:clerk_idp_oauth_access_token
idstringrequired
client_idstringrequired
subjectstringrequired
scopesarray<string>required
audarray<string>optional
The audiences of the access token. Omitted when no audience is set.
actobjectoptional
The actor chain of an access token issued by an OAuth 2.0 Token Exchange (RFC 8693 section 4.1). Omitted for other access tokens.
revokedbooleanrequired
revocation_reasonstringrequired
expiredbooleanrequired
expirationnumberrequired
created_atnumberrequired
updated_atnumberrequired
400Returned when the request is invalid.
errorsarray<object>required
404Returned when the access token cannot be found.
errorsarray<object>required

Error handling

A 400 is returned when the request is invalid, and a 404 when the access token cannot be found. Use access_token to provide the token; secret is deprecated and should be replaced with access_token.