Access Token Decoder
Decode API access tokens in JWT format to understand their permissions, scope, and validity. Access tokens authorize requests to protected resources.
Access Token Purpose
| Function | Description | AuthorizationProves the bearer can access resources ScopeDefines what actions are permitted IdentityOften contains user/client information ExpirationLimits how long access is granted
Access Token Claims
ClaimPurposeExample subResource owner"user_123" client_idApplication"my_app" scopePermissions"read write delete" audAPI identifier"https://api.example.com" | exp | Expiration | 1699900800 |
Access Token Decoder
``javascript
function decodeAccessToken(token) {
const parts = token.split('.');
if (parts.length !== 3) {
return {
format: 'opaque',
note: 'Opaque tokens must be validated via introspection endpoint',
hint: 'POST to /oauth/introspect with token parameter'
};
}
const decode = (s) => JSON.parse(atob(s.replace(/-/g, '+').replace(/_/g, '/')));
const payload = decode(parts[1]);
// Parse scopes
const scopes = payload.scope
? payload.scope.split(' ')
: payload.scp || [];
// Calculate remaining validity
const now = Math.floor(Date.now() / 1000);
const remainingSeconds = payload.exp ? payload.exp - now : null;
return {
format: 'jwt',
subject: payload.sub,
clientId: payload.client_id || payload.azp,
audience: payload.aud,
scopes,
permissions: payload.permissions || [],
issuedAt: payload.iat ? new Date(payload.iat * 1000) : null,
expiresAt: payload.exp ? new Date(payload.exp * 1000) : null,
remainingTime: remainingSeconds > 0
? ${Math.floor(remainingSeconds / 60)} minutes
: 'EXPIRED',
isExpired: remainingSeconds <= 0
};
}
`
Common Scopes by Provider
| Provider | Scopes | Purpose |
Googlegmail.readonly, drive.fileGoogle API access
GitHubrepo, user:emailRepository and user access
MicrosoftUser.Read, Mail.SendMicrosoft Graph access
| Custom API | read:users, write:posts | Your API permissions |
Access Token Lifecycle
`
1. Client requests token (authorization code, client credentials, etc.)
2. Auth server issues access token (+ optional refresh token)
3. Client sends token in Authorization header
4. Resource server validates token
5. Token expires → use refresh token for new access token
``