API usage

Token introspection

A confidential backend can check whether a token is currently active.

Confidential clients only

POST /oauth/introspect requires the registered client_id, a valid server-held client_secret, and the token being checked. Do not call it from browser bundles, public HTML, or mobile binaries.

Server-side form fields

POST https://auth.bhauu.online/oauth/introspect
Content-Type: application/x-www-form-urlencoded

client_id=YOUR_CLIENT_ID&client_secret=YOUR_SERVER_SIDE_CLIENT_SECRET&token=TOKEN_TO_CHECK

The response reports current activity according to token validity and Bhauu-side user, client, authorization, and session state. Introspection can reduce the stale-session window, but an application still controls its own local session.