Sample - Plaid API
POST/oauth/introspect

Get OAuth token metadata

Retrieves metadata about an OAuth access or refresh token. Supply token and optionally provide client credentials, then inspect active and the returned token metadata.

  • RetriesRetries up to 2×, 500ms backoff, 30s timeout.

4 body fields

OAuth token introspection request, accepted as JSON or application/x-www-form-urlencoded data.

tokenstringrequired
An OAuth token of any type (`refresh_token`, `access_token`, etc)
client_idstringoptional
Your Plaid API `client_id`. The `client_id` is required and may be provided either in the `PLAID-CLIENT-ID` header or as part of a request body.
client_secretstringoptional
Your Plaid API `secret`. The `secret` is required and may be provided either in the `PLAID-SECRET` header or as part of a request body as either `secret` or `client_secret`.
secretstringoptional
Your Plaid API `secret`. The `secret` is required and may be provided either in the `PLAID-SECRET` header or as part of a request body as either `secret` or `client_secret`.

2 status codes
200Returns whether the token is active and, when available, its scope, client, expiration, issuance, subject, audience, issuer, token type, user identifier, and `request_id`.
activebooleanrequired
Boolean indicator of whether or not the presented token is currently active. A `true` value indicates that the token has been issued, has not been revoked, and is within the time window of validity.
scopestringoptional
A space-separated list of scopes associated with this token, in the format described in [https://datatracker.ietf.org/doc/html/rfc6749#section-3.3](https://datatracker.ietf.org/doc/html/rfc6749#section-3.3). Currently accepted values are: `user:read` allows reading user data. `user:write` allows writing user data. `exchange` allows exchanging a token using the `urn:plaid:params:oauth:user-token` subject token type. `mcp:dashboard` allows access to the MCP dashboard server.
client_idstringoptional
Your Plaid API `client_id`. The `client_id` is required and may be provided either in the `PLAID-CLIENT-ID` header or as part of a request body.
expintegeroptional
Expiration time as UNIX timestamp since January 1 1970 UTC
iatintegeroptional
Issued at time as UNIX timestamp since January 1 1970 UTC
substringoptional
Subject of the token
audstringoptional
Audience of the token
issstringoptional
Issuer of the token
token_typestringoptional
Type of the token
user_idstringoptional
User ID of the token
request_idstringrequired
A unique identifier for the request, which can be used for troubleshooting. This identifier, like all Plaid identifiers, is case sensitive.
defaultError response.
errorstringoptional
OAuth error code
Allowed:invalid_requestinvalid_clientinvalid_grantunauthorized_clientinvalid_scopeunsupported_grant_type
error_descriptionstringoptional
A human-readable description of the error
error_uristringoptional
A URI identifying the specific error
request_idstringrequired
A unique identifier for the request, which can be used for troubleshooting. This identifier, like all Plaid identifiers, is case sensitive.

Error handling

token is required and must be an OAuth token such as an access or refresh token. Provide client_id and the corresponding client_secret or secret through the supported request fields or authentication headers.