Token management

Token validation, revocation, and user info endpoints.

Token validation

Check if an access token is valid.

HTTP

Request

GET https://auth.enbox.net/introspect?token=eyJhbGciOiJIUzI1NiIsInR...

Query parameters

Parameter	Type	Required	Description
token	string	✅	The access token

Response

{
  "active": true,
  "exp": 1672531199,
  "client_id": "my-client",
  "scope": ["read", "write"],
  "user_id": "123"
}

Revoke token

Revoke an access or refresh token.

HTTP

Request

POST https://auth.enbox.net/revoke
Content-Type: application/x-www-form-urlencoded

token=access-token-xyz
&client_id=myapp-client-id

Body parameters

Parameter	Type	Required	Description
token	string	✅	The token to revoke
client_id	string	✅	The application’s Client ID

Response

{
  "status": "revoked"
}

User info

Retrieve user profile information associated with an access token.

HTTP

Request

GET https://auth.enbox.net/userinfo
Authorization: Bearer ACCESS_TOKEN

Response

{
  "sub": "123456789",
  "name": "John Doe",
  "email": "john@example.com"
}

Security best practices

• Always use PKCE for mobile and SPA apps
• Store access tokens securely (e.g. Keychain on iOS, EncryptedStorage on Android)
• Set short expiration times for access tokens and use refresh tokens
• Restrict client_id usage by domain or IP address

Conclusion

This API provides a secure OAuth 2.0 implementation with PKCE. Developers can integrate it easily for authentication and secure API access.

Need help? Contact support at welcome@enbox.me.