Token Introspection
Asking the authorisation server whether a token is currently valid, rather than validating it locally from its signature.
The two token validation strategies trade the same thing in opposite directions.
Local validation of a signed JWT is fast and requires no network call — and it cannot see revocation. A token remains valid until it expires, whatever has happened to the user's account.
Introspection calls the authorisation server, which knows the current state, so revocation takes effect immediately. The cost is a network call on every request and a hard dependency on the authorisation server's availability.
The usual resolution is not to choose but to stratify: short-lived access tokens validated locally for ordinary requests, with introspection reserved for high-value operations where immediate revocation genuinely matters. The exposure window then equals the token lifetime, which is a number you control.
Where introspection is genuinely required: opaque tokens by design (a legitimate choice — they leak nothing and are meaningless if stolen), regulated environments requiring immediate revocation, and architectures where the authorisation server is close and highly available.
The middle option worth knowing: a short-lived revocation list or event stream that resource servers subscribe to, giving near-immediate revocation without a per-request call.