How to implement access_token validation?

[Amoki]

I have an OP and an API.

The API receives a call with an access_token. The API must know from where this token is coming:
Is it a user token? Through which client?
Or is it a client token (client_credentials)?
Which scopes this token has?

The /userinfo endpoint only works if the openid scope is used and there is no way to make it mandatory.
The /introspect endpoint tells us which app and what are the scopes but can't tell us if the token belongs to a user without openid scope or a client.

How can I validate an access_token?

[Cediddi]

I'm also having this issue, how did you solved your problem?