# Introspect a token (/core/embed/authentication/how-to/token-introspection)





<CalloutContainer type="info">
  <CalloutDescription>
    **Target Audience**: Developers & Non technical users
  </CalloutDescription>
</CalloutContainer>

### Goal [#goal]

Decode a signed Toucan AI token to inspect its internal payload and verify its validity.

***

### Prerequisites [#prerequisites]

* A [Toucan AI account](/core/getting-started/quick-start/subscribe-to-toucan) with active access.
* A previously [generated token](/core/embed/authentication/how-to/authentication-and-tokens) (sandbox or production).

***

### Steps [#steps]

#### 1. Access the Embed settings [#1-access-the-embed-settings]

* Click on the **Settings** button in the main navigation menu.
* Select the **Embed & access** tab to view the integration and security configurations.

#### 2. Locate the introspection tool [#2-locate-the-introspection-tool]

* Scroll to the **Token Introspection** section.
* This interface is designed to parse and display the metadata of any Toucan AI authentication token.

#### 3. Input and decode the token [#3-input-and-decode-the-token]

* Copy the token string you wish to examine.
* Paste the string into the **JWT Token** field.
* Click the **Introspect Token** button to trigger the decoding process.

#### 4. Review token metadata&#x20; [#4-review-token-metadata-]

The tool will display the following decoded parameters:

* **User Information**: Includes the `distinctId` and the assigned `role`.
* **Custom Attributes**: Displays all key-value pairs used for Row-Level Security (e.g., `department: "finance"`).
* **Permissions**: Lists granular access rights like `can_view`, `can_edit`, or `can_query`.
* **Expiration**: Shows the exact timestamp when the token will become invalid.

#### 5. Validate results [#5-validate-results]

* Verify that the attributes match the intended user context.
* If the data is incorrect or the status indicates the token has expired, generate a new credential via the sandbox or API.

<img alt="Token Introspection" src="__img0" />

***

### Conclusion [#conclusion]

Token introspection provides a non-destructive way to audit user identity propagation and permission scoping. Ensuring token accuracy at this stage prevents unauthorized access or "Failed to load" errors in the embedded environment.

**Suggested Next Step**: [How-to: Embed a dashboard](/core/embed/embedding-overview/how-to/embed-a-dashboard) or [How-to: Configure Row-Level Security (RLS)](/core/embed/permissions-and-row-level-security/how-to/apply-rls-to-your-database)