問題文
A resource server wants to check whether an access token it received is still current before it serves a request. Which capability does the platform expose?
選択肢
- The identity address, which reports the token's expiry, along with the identifier of the user the token was issued for and the scopes it carries.
- Nothing, because tokens cannot be inspected, and a resource server has to call the interface and read the error that comes back to learn that a token has expired.
- Token introspection, where the caller sends its own client identifier and secret and the platform reports the state of the token.
- Dynamic client registration, which lets the resource server create integrations in the org on demand and therefore also lets it query the state of the tokens those integrations have issued, since registration and introspection are exposed through the same endpoint.