TASK
Parse OAuth 2.0 token responses
OAuth 2.0 returns access_token, token_type, expires_in, and optionally refresh_token. Learn to parse and use the token response correctly.
- 1
An OAuth 2.0 token response is a JSON object: {access_token, token_type: "Bearer", expires_in: 3600, refresh_token, scope}. The access_token is used in the Authorization header. The refresh_token obtains a new access_token when it expires. Store the refresh_token securely (HttpOnly cookie) — it has a longer lifetime and greater access.
- 2 JWT Decoder →
Decode the access_token if it is a JWT. Inspect the claims (sub, exp, scope, iss, aud) to understand the token's permissions and expiration. If it is an opaque token, call the introspection endpoint to get the token info.
- 3 JSON Formatter →
Format the token response JSON to inspect all fields. Verify: token_type is "Bearer", expires_in is reasonable (3600 = 1 hour), scope matches what you requested. Store the expiration timestamp to proactively refresh before expiry.
Frequently asked questions
- What is a refresh token?
- A refresh token is a credential used to obtain a new access token when the current one expires. It has a longer lifetime (days to weeks) and is stored securely (HttpOnly cookie, secure storage). The access token is short-lived (minutes to hours) and sent to APIs. This limits the exposure window if an access token is stolen.
- What is the token_type field?
- It indicates how to use the token. "Bearer" means put it in the Authorization header: "Authorization: Bearer <token>". This is the only widely supported type. Other types (MAC, POP) were proposed but not adopted. Always check token_type and use the correct mechanism.
Workflows that solve this
Compare two YAML configs via JSON
Convert YAML configs to JSON for diff-friendly comparison of structured values. PIPELINE
Encode a JSON payload for URL transport
Prepare a JSON document for a URL parameter: pretty-print, Base64-encode, then percent-encode — the exact inverse of the nested-parameter decode chain. PIPELINE
HJSON to JSON Format
Format HJSON then convert to standard JSON. PIPELINE
Format JSON and compute integrity checksum
Pretty-print a JSON document and compute a CRC32 checksum to detect any subsequent modifications. PIPELINE
Minify and validate JSON
Format JSON for inspection and validate it is syntactically correct in one pass. PIPELINE
Format JSON and generate TypeScript interface
Format a JSON document then infer a TypeScript interface definition in one chain. PIPELINE
Validate, format, then convert JSON to YAML
Convert a (possibly minified) JSON config to YAML, catching syntax errors at the first node instead of producing subtly wrong YAML. PIPELINE
JSON5 to JSON Format
Format JSON5 then convert to standard JSON. PIPELINE
JSONC to JSON Format
Format JSONC (JSON with comments) then convert to standard JSON. PIPELINE
Decode JWT and inspect payload
Decode a JWT token to its header and payload, then pretty-print the JSON for inspection. PIPELINE
Decode and format a JWT payload
Parse a JWT token, extract its payload, and format the JSON for inspection. PIPELINE
Parse Query String and Format JSON
Parse query string into key-value pairs then format as JSON. PIPELINE
Convert TOML to JSON
Parse a TOML configuration file into JSON for tools and APIs that expect JSON input. PIPELINE
Convert TOML to YAML via JSON
Transform a TOML configuration file into YAML format, using JSON as an intermediate representation. PIPELINE
Decode nested URL parameter (Base64 JSON)
Unwrap a URL parameter that carries URL-encoded Base64 JSON into readable, formatted JSON. PIPELINE
Generate TypeScript interfaces from YAML
Convert a YAML document to TypeScript interface definitions, using JSON as an intermediate format. PIPELINE
Learn more
Want to understand why?
How to Build a Secure API Gateway
Design a secure API gateway that handles authentication, rate limiting, request validation, and threat protection for backend services. TUTORIAL
How to Encode JWT Tokens
Create JSON Web Tokens with a header, payload, and signature for authentication. TUTORIAL
Anti-CSRF
Anti-CSRF is the set of measures that defend against cross-site request forgery, including CSRF tokens, SameSite cookies, and Origin/Referer checks. GLOSSARY
Broken Access Control
Broken access control is missing or bypassable authorization checks that let users perform actions or access resources they are not entitled to. GLOSSARY
Related tools
JWT Decoder
Decode and inspect JWT header, payload, and time claims with expiry status. Free, private, and 100% client-side. TOOL
JSON Formatter
Format, minify, or sort JSON online. Free, private, and 100% client-side. TOOL
Base64 Decoder
Decode Base64 data back to readable text online. Free, private, and 100% client-side. TOOL