Pull request (OPEN) · PR #1018 fix(indiekit): send the token to introspect in the request body · @rmdes
Fixes #1017
introspectToken sends the token as a form-encoded token parameter in the POST body (RFC 7662 §2.1) instead of in the URL. The Authorization header is unchanged.
The introspection mocks now match that request (no query string, token in the body), so the existing introspectToken tests fail on main with Mock dispatch not matched for path '/introspect?token=JWT'. An endpoint-auth test covers the other side: a token sent only in the body is accepted.