According to the documentation the endpoint looks like
GET /debug_token?
input_token={input-token}&
access_token={access-token}
w
OK, so if one needs an app access token, app_id|app_secret
(both values concatenated with a pipe symbol in the middle) always works.
The method getApplicationAccessToken
seems to have been protected in the PHP SDK up to 3.2.2 – whereas getAppId
and getAppSecret
are already public in that version; so those could be the alternative to hard-coding id and secret in place.