# Validate Okta token in java

**URL:** <https://devforum.okta.com/t/validate-okta-token-in-java/4666>\
**Category:** Questions\
**Created:** [March 29, 2019, 1:46am UTC](https://devforum.okta.com/t/validate-okta-token-in-java/4666 "2019-03-29T01:46:55Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jivanpatil](https://avatars.discourse-cdn.com/v4/letter/j/e95f7d/32.png) [@jivanpatil](https://devforum.okta.com/u/jivanpatil)\
**Post date:** [March 29, 2019, 1:46am UTC](https://devforum.okta.com/t/validate-okta-token-in-java/4666/1 "2019-03-29T01:46:55Z")

</div>

Is it possible to validate the access token received in a request locally in java ? My use case is without making a call to Okta api, is it possible to validate access token locally within java code ? Does okta allow that ? If so how ?

---

<div class="post-metadata">

**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\
**Post date:** [March 29, 2019, 9:23am UTC](https://devforum.okta.com/t/validate-okta-token-in-java/4666/2 "2019-03-29T09:23:41Z")

</div>

Hi @jivanpatil

If the access token was issued by a custom authorization server (eg. issuer is something like “[https://org.okta.com/oauth2/default](https://org.okta.com/oauth2/default)”), then you can retrieve the signing keys from /keys endpoint (eg. “[https://org.okta.com/oauth2/default/v1/keys](https://org.okta.com/oauth2/default/v1/keys)”) and use a JWT verifier such as [this one](https://github.com/okta/okta-jwt-verifier-java) in order to verify the token locally.

---

<div class="post-metadata">

**Author:** ![Shubham6541](https://avatars.discourse-cdn.com/v4/letter/s/b5a626/32.png) [@Shubham6541](https://devforum.okta.com/u/Shubham6541)\
**Post date:** [April 5, 2020, 12:53pm UTC](https://devforum.okta.com/t/validate-okta-token-in-java/4666/3 "2020-04-05T12:53:24Z")

</div>

what if it is issued by org authorizatipon server?  
How can we validate it?  
Please answer.

---

<div class="post-metadata">

**Author:** ![dragos](https://sea1.discourse-cdn.com/oktadev/user_avatar/devforum.okta.com/dragos/32/1313_2.png) [@dragos](https://devforum.okta.com/u/dragos)\
**Post date:** [April 6, 2020, 2:16am UTC](https://devforum.okta.com/t/validate-okta-token-in-java/4666/4 "2020-04-06T02:16:48Z")

</div>

Hi @Shubham6541

You can use the same call basically as for the custom authorization servers:

```auto
curl --location --request POST 'https://dragos.okta.com/oauth2/v1/introspect' \
--header 'Accept: application/json' \
--header 'Authorization: Basic MG9hN...' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--data-urlencode 'token=TOKEN_HERE'

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 24, 2024, 7:08pm UTC](https://devforum.okta.com/t/validate-okta-token-in-java/4666/5 "2024-01-24T19:08:27Z")

</div>

Closed on January 24, 2024, 7:08pm UTC

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.