Supabase Auth Token Introspection Endpoint

[wdoppenberg]

Would it be possible to add (access) token introspection to Auth? This would help with backend-to-backend token validation, and is hopefully not a great deal of work.

Prior art

Doing token introspection with Keycloak is as follows:

curl -X POST \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "token=<your-token>" \
  -d "client_id=<your-client-id>" \
  -d "client_secret=<your-client-secret>" \
  "http://<keycloak-host>/realms/<realm-name>/protocol/openid-connect/token/introspect"

Returns

{
  "active": true,
  "exp": 1516239022,
  "sub": "user123",
  "client_id": "my-client",
  "scope": "openid email profile"
}

Please let me know your thoughts.