See openid-connect Menu

Validate an Access Token

Deprecation Notice

There is a more recent version of this OpenId Connect API available. Learn more.

This endpoint will be removed from service on April 20th 2021.

Use this API to check the status of a session that was started via either the Authentication or Username/Password flow.

Note that a successful request to this API will return a HTTP 200 - Success but this does not indicate the session is still valid. You need to check the boolean active attribute which is returned in the payload body.

Resource URL


Header Parameter



Required if Token Endpoint Authentication Method is set to Basic

Set to Basic <base64 encoded "clientId:clientSecret">.

The client_id and client_secret are generated when you configure your OpenId Connect app in OneLogin.

e.g. Using Node.js this would be

new Buffer(`${this.client_id}:${this.client_secret}`).toString('base64');




Resource Parameter




Set to the region of your OneLogin instance.

  • openid-connect
  • openid-connect-eu
e.g. If your OneLogin instance is located in Europe then use

Request Parameter




Set to access_token that will be validated



Set to “access_token”



The OneLogin generated Client ID for your OpenID Connect app.

Required if Token Endpoint Authentication method is set to POST.



The OneLogin generated Client Secret for your OpenID Connect app.

Required if Token Endpoint Authentication method is set to POST.

Sample Request Body


Sample Response

The session is valid

    "active": true,
    "token_type": "access_token",
    "sub": "32916209",
    "client_id": "cc0e6bc0-644a-0135-fd0d-02d3582f0df061892",
    "exp": 1507952334,
    "iat": 1507948734,
    "iss": "",
    "jti": "OTY3MjhlZGMtNmVlMS00N2ZjLTk4OGItM2RhODgyYWExODNk"

The session has expired or been revoked

    "active": false
    "error": "invalid_request",
    "error_description": "missing required parameter(s). (token)"

Response Elements

active Indicates if the current session is valid
token_type The type of token that was validated
sub The OneLogin ID for the user that started the session
client_id The OneLogin generated Client ID for the OpenID Connect app that started the session.
exp A UNIX epoch time representing the expiry date/time of the token
iat A UNIX epoch time representing the issue date/time of the token
iss The issuing authority of the token
jti A unique identifier for the token

Sample Code


Replace sample values indicated by < > with your actual values.

curl -XPOST "https://<region>" \
-H "Authorization: Basic <base64 encoded client_id:client_secret>" \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "token=<access_token>&token_type_hint=access_token"

Postman Collection

Run In Postman

    Clicking Run in Postman button navigates to the page where you can fork the collection to your workspace. Forking the collection into your workspace will enable you to contribute to the source collection using pull requests. You can also view the collection in a public workspace if you like and even import a copy of the collection using the links present on the screen.

Have a Question?

Found a problem or a bug? Submit a support ticket.

Looking for walkthroughs or how-to guides on OneLogin's user and admin features? Check out the documentation in our Knowledge Base.

Have a product idea or request? Share it with us in our Ideas Portal.