Token Endpoints

POST /api/oauth/token

{
  "access_token": "eyJhbGciOiJIUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 7200,
  "refresh_token": "def456...",
  "scope": "openid courses:read students:read",
  "created_at": 1710000000,
  "school_id": "550e8400-e29b-41d4-a716-446655440000",
  "school_subdomain": "demo"
}

async function refreshAccessToken(storedRefreshToken) {
  const res = await fetch(TOKEN_URL, {
    method: "POST",
    headers: { "Content-Type": "application/x-www-form-urlencoded" },
    body: new URLSearchParams({
      grant_type: "refresh_token",
      refresh_token: storedRefreshToken,
      client_id: CLIENT_ID,
      // Include client_secret for confidential clients:
      // client_secret: CLIENT_SECRET,
    }),
  });

  if (!res.ok) throw new Error(`Refresh failed: ${res.status}`);

  const { access_token, refresh_token, expires_in } = await res.json();

  // Always persist the latest refresh_token
  await store.set("oauth_tokens", {
    access_token,
    refresh_token: refresh_token ?? storedRefreshToken,
    expires_at: Date.now() + expires_in * 1000,
  });

  return access_token;
}

POST /api/oauth/revoke

POST /api/oauth/introspect

{
  "active": true,
  "scope": "openid courses:read",
  "client_id": "abc123",
  "token_type": "Bearer",
  "exp": 1710007200
}

{
  "active": false
}

GET /api/oauth/userinfo
POST /api/oauth/userinfo

Authorization: Bearer <access_token>

{
  "sub": "550e8400-e29b-41d4-a716-446655440000",
  "name": "Jane Doe",
  "email": "jane@example.com",
  "email_verified": true
}

{
  "error": "invalid_grant",
  "error_description": "The authorization code has expired or has already been used."
}