Documentation

Verifying access tokens

How a Micropub endpoint, or any other API on your own website, checks the tokens apps send it.

How it fits together

1. An app signs you in through myindieauth.com and asks for scopes such as create.
2. It sends requests to your endpoint with Authorization: Bearer ACCESS_TOKEN.
3. Your endpoint asks this server whether the token is valid, using a credential only your site knows.
4. If the token is active, belongs to your website and carries the scope the request needs, your endpoint does the work.

1. Create a credential

Create a resource server credential from your account and store it in your endpoint's configuration. Treat it like a password. A credential can only look up tokens issued for websites on your account.

2. Call the introspection endpoint

curl https://dev.myindieauth.com/introspect \
  -H "Authorization: Bearer YOUR_CREDENTIAL" \
  -d "token=ACCESS_TOKEN"

An active token:

{
  "active": true,
  "me": "https://example.com/",
  "client_id": "https://app.example.com/",
  "scope": "create media",
  "iat": 1757750000,
  "exp": 1758354800
}

Anything else — expired, revoked, unknown, or belonging to another account — returns only:

{ "active": false }

A missing or wrong credential gets HTTP 401.

3. Check the response

• active is true.
• me is your website's URL (if you have several websites on one account, make sure it is the one this endpoint serves).
• scope, split on spaces, contains what the request needs, e.g. create to publish a post.

Example in PHP

function verify_token(string $token, string $scope): ?array
{
    $ch = curl_init('https://dev.myindieauth.com/introspect');
    curl_setopt_array($ch, [
        CURLOPT_POST           => true,
        CURLOPT_POSTFIELDS     => http_build_query(['token' => $token]),
        CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . getenv('INDIEAUTH_CREDENTIAL')],
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT        => 5,
    ]);
    $info = json_decode((string) curl_exec($ch), true);

    if (($info['active'] ?? false) !== true
        || ($info['me'] ?? '') !== 'https://example.com/'
        || !in_array($scope, explode(' ', $info['scope'] ?? ''), true)) {
        return null;
    }

    return $info;
}

You may cache a positive result for a short time (a minute or so) to save requests, but keep in mind that revoking an app will then take that long to take effect on your site.

Letting apps find your endpoint

Micropub clients discover everything from your home page: the indieauth-metadata link for signing in, and <link rel="micropub" href="…"> for your endpoint.