> This page is for Data API, version v2 (default).
> For other versions, use one of these documentation indexes:
> - v2 (default): https://developers.webflow.com/data/v2.0.0/llms.txt
> - v2 Beta: https://developers.webflow.com/data/v2.0.0-beta/llms.txt
> - v1: https://developers.webflow.com/data/v1.0.0/llms.txt

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developers.webflow.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developers.webflow.com/_mcp/server.

# Get Authorization Info

GET https://api.webflow.com/v2/token/introspect

Information about the authorization tokenAccess to this endpoint requires a bearer token from either a [Data Client App](/data/docs/data-clients/getting-started), a [Workspace token](/data/reference/authentication/workspace-token), or a [Site token](/data/reference/authentication/site-token).The `application` object is only returned for tokens issued to an OAuth app. For tokens without an OAuth app, such as Site and Workspace API tokens (`grantType: client_credentials`), the response omits `application`.

Reference: https://developers.webflow.com/data/reference/token/introspect

## Authentication

- `Authorization` header (bearer token, required) — Bearer authentication of the form `Bearer <token>`, where token is your auth token.

## Response

### 200

Request was successful

- `authorization` (TokenIntrospectGetResponsesContentApplicationJsonSchemaAuthorization, optional) — The Authorization object
- `application` (TokenIntrospectGetResponsesContentApplicationJsonSchemaApplication, optional) — Details of the OAuth app the token belongs to. Present only for tokens issued to an OAuth app. Omitted for `client_credentials` tokens without an OAuth app, such as Site and Workspace API tokens.

## Errors

### 401 Unauthorized Error

Provided access token is invalid or does not have access to requested resource

- `code` (enum, optional) — Error code
  - Allowed values: `aeo_input_validation`, `analyze_filter_conflict`, `analyze_input_validation`, `analyze_unsupported_filter`, `bad_request`, `batch_too_large`, `before_historical_floor`, `billing_provider_unavailable`, `branch_merge_conflict`, `branch_merge_in_progress`, `branch_not_found`, `branch_publish_failed`, `branch_sync_pending`, `branch_task_not_found`, `branch_update_in_progress`, `brand_not_configured`, `cannot_invite_self`, `cannot_remove_self`, `cannot_update_user_role`, `client_seats_unavailable`, `collection_not_found`, `competitors_not_configured`, `conflict`, `conflicting_scope_filters`, `default_site_role_required`, `duplicate_collection`, `duplicate_member_in_request`, `duplicate_site_in_request`, `duplicate_user_email`, `ecommerce_not_enabled`, `end_time_too_recent`, `enterprise_provisioning_upstream_error`, `enterprise_self_provisioning_not_entitled`, `forbidden`, `forms_require_republish`, `incompatible_webhook_filter`, `insufficient_permissions`, `insufficient_seats`, `internal_error`, `invalid_auth_version`, `invalid_credentials`, `invalid_domain`, `invalid_resolution`, `invalid_site_role`, `invalid_time_range`, `invalid_user_email`, `invalid_workspace_role`, `invite_expired`, `invite_role_conflict`, `item_not_found`, `managed_by_scim`, `member_already_has_access`, `member_has_no_site_access`, `member_is_paying_client`, `member_not_found`, `member_not_removable`, `member_role_conflict`, `missing_scopes`, `no_domains`, `no_members_or_invites`, `not_authorized`, `not_enterprise_plan_site`, `not_enterprise_plan_workspace`, `optimize_before_historical_floor`, `optimize_input_validation`, `optimize_invalid_interval`, `optimize_unknown_dimension`, `optimize_unknown_goal`, `optimize_unknown_optimization`, `optimize_unsupported_group_by`, `order_not_found`, `page_cannot_branch`, `resource_not_found`, `service_unavailable`, `site_access_not_applicable_to_member`, `site_access_not_scopable_for_role`, `site_access_roles_must_match`, `site_not_in_workspace`, `site_role_id_invalid`, `site_role_id_not_allowed`, `site_role_id_required`, `site_specific_access_disabled`, `site_specific_access_not_entitled`, `time_range_too_wide`, `too_many_requests`, `unsupported_bot_provider`, `unsupported_version`, `unsupported_webhook_trigger_type`, `user_limit_reached`, `user_not_found`, `users_not_enabled`, `validation_error`, `workspace_invite_not_found`, `workspace_member_managed_by_scim`, `workspace_member_not_found`, `workspace_member_not_removable`, `workspace_role_not_grantable`
- `message` (string, optional) — Error message
- `externalReference` (string, optional) — Link to more information
- `details` (list of TokenIntrospectGetResponsesContentApplicationJsonSchemaDetailsItems, optional) — Array of errors

### 400 Client Request Error

Request body was incorrectly formatted.

- `code` (enum, optional) — Error code
  - Allowed values: `aeo_input_validation`, `analyze_filter_conflict`, `analyze_input_validation`, `analyze_unsupported_filter`, `bad_request`, `batch_too_large`, `before_historical_floor`, `billing_provider_unavailable`, `branch_merge_conflict`, `branch_merge_in_progress`, `branch_not_found`, `branch_publish_failed`, `branch_sync_pending`, `branch_task_not_found`, `branch_update_in_progress`, `brand_not_configured`, `cannot_invite_self`, `cannot_remove_self`, `cannot_update_user_role`, `client_seats_unavailable`, `collection_not_found`, `competitors_not_configured`, `conflict`, `conflicting_scope_filters`, `default_site_role_required`, `duplicate_collection`, `duplicate_member_in_request`, `duplicate_site_in_request`, `duplicate_user_email`, `ecommerce_not_enabled`, `end_time_too_recent`, `enterprise_provisioning_upstream_error`, `enterprise_self_provisioning_not_entitled`, `forbidden`, `forms_require_republish`, `incompatible_webhook_filter`, `insufficient_permissions`, `insufficient_seats`, `internal_error`, `invalid_auth_version`, `invalid_credentials`, `invalid_domain`, `invalid_resolution`, `invalid_site_role`, `invalid_time_range`, `invalid_user_email`, `invalid_workspace_role`, `invite_expired`, `invite_role_conflict`, `item_not_found`, `managed_by_scim`, `member_already_has_access`, `member_has_no_site_access`, `member_is_paying_client`, `member_not_found`, `member_not_removable`, `member_role_conflict`, `missing_scopes`, `no_domains`, `no_members_or_invites`, `not_authorized`, `not_enterprise_plan_site`, `not_enterprise_plan_workspace`, `optimize_before_historical_floor`, `optimize_input_validation`, `optimize_invalid_interval`, `optimize_unknown_dimension`, `optimize_unknown_goal`, `optimize_unknown_optimization`, `optimize_unsupported_group_by`, `order_not_found`, `page_cannot_branch`, `resource_not_found`, `service_unavailable`, `site_access_not_applicable_to_member`, `site_access_not_scopable_for_role`, `site_access_roles_must_match`, `site_not_in_workspace`, `site_role_id_invalid`, `site_role_id_not_allowed`, `site_role_id_required`, `site_specific_access_disabled`, `site_specific_access_not_entitled`, `time_range_too_wide`, `too_many_requests`, `unsupported_bot_provider`, `unsupported_version`, `unsupported_webhook_trigger_type`, `user_limit_reached`, `user_not_found`, `users_not_enabled`, `validation_error`, `workspace_invite_not_found`, `workspace_member_managed_by_scim`, `workspace_member_not_found`, `workspace_member_not_removable`, `workspace_role_not_grantable`
- `message` (string, optional) — Error message
- `externalReference` (string, optional) — Link to more information
- `details` (list of TokenIntrospectGetResponses4XxContentApplicationJsonSchemaDetailsItems, optional) — Array of errors

### 500 Server Error

We had a problem with our server. Try again later.

- `code` (enum, optional) — Error code
  - Allowed values: `aeo_input_validation`, `analyze_filter_conflict`, `analyze_input_validation`, `analyze_unsupported_filter`, `bad_request`, `batch_too_large`, `before_historical_floor`, `billing_provider_unavailable`, `branch_merge_conflict`, `branch_merge_in_progress`, `branch_not_found`, `branch_publish_failed`, `branch_sync_pending`, `branch_task_not_found`, `branch_update_in_progress`, `brand_not_configured`, `cannot_invite_self`, `cannot_remove_self`, `cannot_update_user_role`, `client_seats_unavailable`, `collection_not_found`, `competitors_not_configured`, `conflict`, `conflicting_scope_filters`, `default_site_role_required`, `duplicate_collection`, `duplicate_member_in_request`, `duplicate_site_in_request`, `duplicate_user_email`, `ecommerce_not_enabled`, `end_time_too_recent`, `enterprise_provisioning_upstream_error`, `enterprise_self_provisioning_not_entitled`, `forbidden`, `forms_require_republish`, `incompatible_webhook_filter`, `insufficient_permissions`, `insufficient_seats`, `internal_error`, `invalid_auth_version`, `invalid_credentials`, `invalid_domain`, `invalid_resolution`, `invalid_site_role`, `invalid_time_range`, `invalid_user_email`, `invalid_workspace_role`, `invite_expired`, `invite_role_conflict`, `item_not_found`, `managed_by_scim`, `member_already_has_access`, `member_has_no_site_access`, `member_is_paying_client`, `member_not_found`, `member_not_removable`, `member_role_conflict`, `missing_scopes`, `no_domains`, `no_members_or_invites`, `not_authorized`, `not_enterprise_plan_site`, `not_enterprise_plan_workspace`, `optimize_before_historical_floor`, `optimize_input_validation`, `optimize_invalid_interval`, `optimize_unknown_dimension`, `optimize_unknown_goal`, `optimize_unknown_optimization`, `optimize_unsupported_group_by`, `order_not_found`, `page_cannot_branch`, `resource_not_found`, `service_unavailable`, `site_access_not_applicable_to_member`, `site_access_not_scopable_for_role`, `site_access_roles_must_match`, `site_not_in_workspace`, `site_role_id_invalid`, `site_role_id_not_allowed`, `site_role_id_required`, `site_specific_access_disabled`, `site_specific_access_not_entitled`, `time_range_too_wide`, `too_many_requests`, `unsupported_bot_provider`, `unsupported_version`, `unsupported_webhook_trigger_type`, `user_limit_reached`, `user_not_found`, `users_not_enabled`, `validation_error`, `workspace_invite_not_found`, `workspace_member_managed_by_scim`, `workspace_member_not_found`, `workspace_member_not_removable`, `workspace_role_not_grantable`
- `message` (string, optional) — Error message
- `externalReference` (string, optional) — Link to more information
- `details` (list of TokenIntrospectGetResponses5XxContentApplicationJsonSchemaDetailsItems, optional) — Array of errors

## Types

### TokenIntrospectGetResponsesContentApplicationJsonSchemaAuthorization

The Authorization object

- `id` (string, optional) — The unique ID of the Authorization instance
- `createdOn` (string, optional) — The date the Authorization was created
- `lastUsed` (string, optional) — The date the Authorization was last used
- `grantType` (string, optional) — The grant type of the Authorization
- `rateLimit` (integer, optional) — The default rate limit for the Authorization (requests/min)
- `scope` (string, optional) — Comma separted list of OAuth scopes corresponding to the Authorization
- `authorizedTo` (TokenIntrospectGetResponsesContentApplicationJsonSchemaAuthorizationAuthorizedTo, optional)

### TokenIntrospectGetResponsesContentApplicationJsonSchemaApplication

Details of the OAuth app the token belongs to. Present only for tokens issued to an OAuth app. Omitted for `client_credentials` tokens without an OAuth app, such as Site and Workspace API tokens.

- `id` (string, optional) — Unique identifier for the Application
- `description` (string, optional) — Application description provided by the developer
- `homepage` (string, optional) — Application homepage URL provided by the developer
- `displayName` (string, optional) — Application name provided by the developer

### TokenIntrospectGetResponsesContentApplicationJsonSchemaDetailsItems

### TokenIntrospectGetResponses4XxContentApplicationJsonSchemaDetailsItems

### TokenIntrospectGetResponses5XxContentApplicationJsonSchemaDetailsItems

### TokenIntrospectGetResponsesContentApplicationJsonSchemaAuthorizationAuthorizedTo

- `siteIds` (list of any, optional) — Array of Sites this app is authorized to
- `workspaceIds` (list of any, optional) — Array of Workspaces this app is authorized to
- `userIds` (list of any, optional) — Array of Users this app is authorized to

## Examples

### OAuthAppToken

**Response**

```json
{
  "authorization": {
    "id": "55818d58616600637b9a5786",
    "createdOn": "2016-10-03T23:12:00.755Z",
    "lastUsed": "2016-10-10T21:41:12.736Z",
    "grantType": "authorization_code",
    "rateLimit": 60,
    "scope": "assets:read,assets:write",
    "authorizedTo": {
      "siteIds": [
        "62f3b1f7eafac55d0c64ef91"
      ],
      "workspaceIds": [
        "52f3b1f7eafac55d0c64ef91"
      ],
      "userIds": [
        "545bbecb7bdd6769632504a7"
      ]
    }
  },
  "application": {
    "id": "55131cd036c09f7d07883dfc",
    "description": "My Amazing App",
    "homepage": "https://webflow.com",
    "displayName": "My Amazing App"
  }
}
```

**SDK Code**

```python OAuthAppToken
import requests

url = "https://api.webflow.com/v2/token/introspect"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript OAuthAppToken
const url = 'https://api.webflow.com/v2/token/introspect';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go OAuthAppToken
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.webflow.com/v2/token/introspect"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby OAuthAppToken
require 'uri'
require 'net/http'

url = URI("https://api.webflow.com/v2/token/introspect")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body
```

```java OAuthAppToken
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.webflow.com/v2/token/introspect")
  .header("Authorization", "Bearer <token>")
  .asString();
```

```php OAuthAppToken
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.webflow.com/v2/token/introspect', [
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp OAuthAppToken
using RestSharp;

var client = new RestClient("https://api.webflow.com/v2/token/introspect");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "Bearer <token>");
IRestResponse response = client.Execute(request);
```

```swift OAuthAppToken
import Foundation

let headers = ["Authorization": "Bearer <token>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.webflow.com/v2/token/introspect")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### ApiToken

**Response**

```json
{
  "authorization": {
    "id": "65a1b2c3d4e5f60718293a4b",
    "createdOn": "2026-10-01T15:04:05.123Z",
    "lastUsed": "2026-10-06T09:30:41.512Z",
    "grantType": "client_credentials",
    "rateLimit": 60,
    "scope": "assets:read,assets:write",
    "authorizedTo": {
      "siteIds": [
        "62f3b1f7eafac55d0c64ef91"
      ],
      "workspaceIds": [],
      "userIds": []
    }
  }
}
```

**SDK Code**

```python ApiToken
import requests

url = "https://api.webflow.com/v2/token/introspect"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript ApiToken
const url = 'https://api.webflow.com/v2/token/introspect';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go ApiToken
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.webflow.com/v2/token/introspect"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby ApiToken
require 'uri'
require 'net/http'

url = URI("https://api.webflow.com/v2/token/introspect")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body
```

```java ApiToken
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.webflow.com/v2/token/introspect")
  .header("Authorization", "Bearer <token>")
  .asString();
```

```php ApiToken
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.webflow.com/v2/token/introspect', [
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp ApiToken
using RestSharp;

var client = new RestClient("https://api.webflow.com/v2/token/introspect");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "Bearer <token>");
IRestResponse response = client.Execute(request);
```

```swift ApiToken
import Foundation

let headers = ["Authorization": "Bearer <token>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.webflow.com/v2/token/introspect")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```