Access Token Decoder
Decode API access tokens in JWT format to understand their permissions, scope, and validity. Access tokens authorize requests to protected resources.
Access Token Purpose
| Function | Description |
|---|---|
| Authorization | Proves the bearer can access resources |
| Scope | Defines what actions are permitted |
| Identity | Often contains user/client information |
| Expiration | Limits how long access is granted |
Access Token Claims
| Claim | Purpose | Example |
|---|---|---|
| sub | Resource owner | "user_123" |
| client_id | Application | "my_app" |
| scope | Permissions | "read write delete" |
| aud | API identifier | "https://api.example.com" |
| exp | Expiration | 1699900800 |
Access Token Decoder
``javascript
function decodeAccessToken(token) {
const parts = token.split('.');
if (parts.length !== 3) {
return {
format: 'opaque',
note: 'Opaque tokens must be validated via introspection endpoint',
hint: 'POST to /oauth/introspect with token parameter'
};
}
const decode = (s) => JSON.parse(atob(s.replace(/-/g, '+').replace(/_/g, '/')));
const payload = decode(parts[1]);
// Parse scopes
const scopes = payload.scope
? payload.scope.split(' ')
: payload.scp || [];
// Calculate remaining validity
const now = Math.floor(Date.now() / 1000);
const remainingSeconds = payload.exp ? payload.exp - now : null;
return {
format: 'jwt',
subject: payload.sub,
clientId: payload.client_id || payload.azp,
audience: payload.aud,
scopes,
permissions: payload.permissions || [],
issuedAt: payload.iat ? new Date(payload.iat * 1000) : null,
expiresAt: payload.exp ? new Date(payload.exp * 1000) : null,
remainingTime: remainingSeconds > 0
? ${Math.floor(remainingSeconds / 60)} minutes
: 'EXPIRED',
isExpired: remainingSeconds <= 0
};
}
`
Common Scopes by Provider
| Provider | Scopes | Purpose |
|---|---|---|
| gmail.readonly, drive.file | Google API access | |
| GitHub | repo, user:email | Repository and user access |
| Microsoft | User.Read, Mail.Send | Microsoft Graph access |
| Custom API | read:users, write:posts | Your API permissions |
Access Token Lifecycle
`
1. Client requests token (authorization code, client credentials, etc.)
2. Auth server issues access token (+ optional refresh token)
3. Client sends token in Authorization header
4. Resource server validates token
5. Token expires → use refresh token for new access token
``