Ory is the largest open source community in the world for cloud software application security. We maintain advanced open source security software solving authentication, authorization, access control, application network security, and delegation. Ory implements a variety of industry and best-practice standards including OAuth 2.0 / OAuth 2.1, OpenID Connect, Zero Trust Networking, Google Zanzibar Policy Framework, FIDO2 U2F, WebAuthn, TOTP, and more.

Ory Community

Does any one know how `introspect` endpoint works in backend? like how it verifies the access token is valid or not?

I believe it verifies the token by checking whether it's expired or revoked:

<https://www.ory.sh/docs/hydra/reference/api#tag/oAuth2/operation/introspectOAuth2Token>

&gt; The introspection endpoint allows to check if a token (both refresh and access) is active or not. An active token is neither expired nor revoked.

So... When putting this together our end point would go where oauth is or?