> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ulm.m1amdocs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Validating Tokens

Once your application obtains access (and ID) tokens from Digital Identity Management, you may want to periodically verify that a token is still valid. You can to achieve this by inspecting the Java Web Token (JWT) or calling the Digital Identity Management's `/oidc/ userInfo` endpoint.

## Inspecting the JWT

In support of OAuth 2.0 and OIDC, Digital Identity Management issues access, refresh, and ID tokens as JSON Web Tokens (JWTs).

**JWT Expiration**

When a token is first issued and delivered to the client, that token's decoded payload contains an expiry time noted in the `exp` field as seconds in UNIX epoch time.

```
**Example token payload **
{
  "sub": "4fa6ffe1-96c0-4780-b3db-d530cdc52a8b",
  "aud": "sensicalDeviceGrant-OIDC-Client",
  "email_verified": true,
  "kid": "rsa1",
  "iss": "https://sensical-ulm-pdt.m1amdocs.io/oidc",
  "name": "Primary User Display Name Here",
  "ulm_user_id": 103,
  "exp": 1610468880,
  "iat": 1610468280,
  "jti": "ac3951cf-e9ad-420f-978f-bbb8e6cf3e5b",
  "email": "tgokcen20210112@mailinator.com"
}
```

Once a token expires, it can no longer be used. The token expiration period can be defined in the Digital Identity Management Admin console for your organization's administrators.

**JWT Signature**

To check that a token was actually signed by Digital Identity Management, use the access token `GET /oidc/jwk` endpoint to obtain all of the Digital Identity Management public keys. The response is a JSON object with a single `keys` field, and that field contains a list of JSON Web Key (JWK) values.

```
**GET /oidc/jwk response**
{
   "keys": [
   {
      "kty": "RSA",
      "e": "AQAB",
      "kid": "rsa1",
      "alg": "RS256",
      "n": "qt6yOiI_wCoCVlGO0MySsez0VkSqhPvDl3rfabOslx35mYEO-n4ABfIT5Gn2zN-CeIcOZ5ugAXvIIRWv5H55-
           tzjFazi5IKkOIMCiz5__MtsdxKCqGlZu2zt-BLpqTOAPiflNPpM3RUAlxKAhnYEqNha6-allPnFQupnW_eTYoy
           uzuedT7dSp90ry0ZcQDimntXWeaSbrYKCj9Rr9W1jn2uTowUuXaScKXTCjAmJVnsD75JNzQfa8DweklTyWQF-Y
           5Ky039I0VIu-0CIGhXY48GAFe2EFb8VpNhf07DP63p138RWQ1d3KPEM9mYJVpQC68j3wzDQYSljpLf9by7TGw"
    }
  ]
}
```

In this case, Digital Identity Management has only a single key with a key ID, or `kid`, of `rsa1` using algorithm, or `alg`, of RS256. The public key `n` value is visible for the purposes of verifying the asymmetric signature on any tokens.

## Calling the `/oidc/userinfo` Endpoint

You can call the `GET /oidc/userinfo` API with an access token. The response includes the latest claim values authorized for the relying party according to the scopes in the specified access token. If the token is invalid for example, because it has been revoked), then Digital Identity Management responds with `HTTP 401 Unauthorized` and a payload that indicates the error code `invalid_token`.

```
**Error Response - body**
{
  "error": "invalid_token",
  "error_description": "Invalid access token: eyJraWQiOiJyc2ExIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiI0
                       ZmE2ZmZlMS05NmMwLTQ3ODAtYjNkYi1kNTMwY2RjNTJhOGIiLCJhenAiOiJzZW5zaWNhbERldm
                       ljZUdyYW50LU9JREMtQ2xpW50IiwiaXNzIjoiaHR0cHM6XC9cL3NlbnNpY2FsLXVsbS1wZHQub
                       TFhbWRvY3MuaW9cL29pZGMiLCJleHAiOjE2MTA1NTE0NTIsImlhdCI6MTYxMDU0Nzg1MiwianR
                       pIjoiYTQ5ZTUwZDktOTEwOS00ZDAwLWJlZWUtZTZjNzM0OTE5ZmRhIn0.Px2yh3AL6mqTvLd6E
                       VTHvAPsisHbfsoIIQ4feRJjaLew-K-29SiRWqnXYzZ2QKqT8cT6i7xZWUEchbtFz900i5Nj66D
                       JeXTw-t1QSFsRrKYPM7a5XfKvQhZ92vDvWeutsFBaS_yAUq6WutBz19vHzbnl39-igQtm8LwbX
                       EJX32hU10mnkm3WMne8HVUVPCSkNRi6a4t7LExzQbVEjmeEjPWUADbGc9zUS-5mA6V1_cUjepY
                       5jXH-NMvyi8MtrYOYSNEd4sIE1z21XD8v6nwxzG5Urz3JjF_TQ8TWls3wcN28JH2Y4lAntURu8
                       G1oHKEtjhf5jHMQ9ER455BWig7EsQ"
}
```

For more details on the `/userinfo` endpoint, refer to the [UserInfo Endpoint](https://docs.vindicia.com/bundle/b_ConnectProductDescription/page/topics/userInfoEndpoint_c.html) topic. Alternatively, to know more about MarketONE OIDC API spec, refer to the [API Reference](https://docs.saas.amdocs.com/bundle/Amdocs_Media-MarketONE-OIDC-Released-resolved/page/index.html) on the Developer Portal.

**Parent topic:**[Single Sign-On](../topics/ssoIntro)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.