---
title: Token
description: The token endpoints support the following actions:
component: pingone-api
page_id: pingone-api:auth:openid-connect-oauth-2/token-intro
canonical_url: https://developer.pingidentity.com/pingone-api/auth/openid-connect-oauth-2/token-intro.html
---

# Token

|   |                                                                                                                                                                                                                                                                                                                                              |
| - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|   | Ping Identity is deprecating JWT-format refresh tokens in favor of opaque tokens, which are more secure. You must update your OIDC-based applications to use opaque refresh tokens by March 1, 2027. Learn more in [Refresh tokens](../../foundations/authentication-concepts/access-tokens-and-id-tokens/token-claims.html#refresh-tokens). |

The token endpoints support the following actions:

* The token endpoint `/{{envID}}/as/token` is used by the client to obtain an access token by presenting its authorization grant. Note that authentication requirements to this endpoint are configured by the application's `tokenEndpointAuthMethod` property. For information about the application's `tokenEndpointAuthMethod` property, refer to the "Applications OIDC settings data model" table in [Application Operations](../../platform/applications/applications-1.html).

* The token introspection endpoint `/{{envID}}/as/introspect` returns the active state of an OAuth 2.0 token and the claims specified in RFC 7662 Section 2.2. The request requires the token parameter, which is the token string.

* The token revocation endpoint `{{envID}}/as/revoke` revokes the token specified in the request. Note that this operation does not apply to the tokens issued for the PingOne API resource.

> **Collapse: Related topics**
>
> * [Access tokens and ID tokens](../../foundations/authentication-concepts/access-tokens-and-id-tokens.html)
>
> * [Token claims](../../foundations/authentication-concepts/access-tokens-and-id-tokens/token-claims.html)