haunt.gg | Introspect

Access tokens are opaque strings, so there is nothing to decode locally. When you need to know whether one is still valid — and which scopes and user it belongs to — ask this endpoint. Follows RFC 7662.

POST/api/auth/oauth2/introspect

You rarely need this in a normal login integration: just call the token endpoint and let a 401 tell you the token is gone. Introspection is for resource servers that are handed a token by someone else and have to validate it on every request.

Authorizations

Authorizationheaderstring

Basic base64(client_id:client_secret). Alternatively send both as form fields.

client_idbodystringrequired

Your app's client ID. Both the id and the secret are required here — there is no anonymous introspection.

client_secretbodystringrequired

Your app's secret.

Body

The body must be application/x-www-form-urlencoded.

tokenbodystringrequired

The access token or refresh token to inspect.

token_type_hintbodystring

access_token or refresh_token. Only a hint.

Example Request

Request

curl -X POST "https://haunt.gg/api/auth/oauth2/introspect" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "YOUR_CLIENT_ID:YOUR_CLIENT_SECRET" \
  -d "token=YOUR_ACCESS_TOKEN"

Response

The token is live and belongs to your app.

{
  "active": true,
  "iss": "https://haunt.gg",
  "client_id": "YOUR_CLIENT_ID",
  "sub": "clz9k2x0a0000s601f8h3d7q2",
  "scope": "openid identify offline_access",
  "iat": 1767222000,
  "exp": 1767225600
}

Rate limit

100 requests per minute per IP address, counted for this endpoint alone.