docs: document introspection active=false on disabled subjects

Clarify SDK integration guidance that provider introspection can return active=false when user/project/client is disabled after token issuance.
2026-02-26 12:38:45 +00:00
parent ebea82f63d
commit fb60a1eccb
2 changed files with 2 additions and 0 deletions
@@ -136,6 +136,7 @@ try {

 `UserInfoException` with `invalid_token` can occur when provider-side subject scope is no longer active (for example user/project disabled) between token issuance and userinfo retrieval.
 `TokenExchangeException` with `invalid_grant` can also occur when provider-side client/user/project state is inactive at exchange time.
+Token introspection can return `active=false` when the token subject (user/project) or client has since been disabled.
 Provider login/authorization steps can also fail with `access_denied` when account status is disabled before completion.
 WebAuthn-based login verification can return credential-style failures for disabled accounts even when authenticator assertions are otherwise valid.
 Existing authenticated sessions may also be invalidated when account status changes to disabled.