Standards in. No lock-in out.

# exchange an OAuth 2.0 code for tokens
curl -X POST https://simezu.com/oauth/token \
  -d grant_type=authorization_code \
  -d code=$AUTH_CODE \
  -d client_id=$CLIENT_ID

# access_token (RS256) + id_token come back
curl https://simezu.com/oauth/token/introspect \
  -d token=$ACCESS_TOKEN
{ "active": true, "actor_type": "user" }