TOKEN_URL='https://oauth.example.com/as/token.oauth2'
INTROSPECT_URL='https://oauth.example.com/as/introspect.oauth2'


TOKEN=$(curl -s -k -X POST "$TOKEN_URL" \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -u "${CLIENT_ID}:${CLIENT_SECRET}" \
  -d 'grant_type=client_credentials&scope=openid profile email' | jq -r '.access_token')


if [ -z "$TOKEN" ] || [ "$TOKEN" = "null" ]; then
  echo "Failed to obtain access token"
  exit 1
fi

echo "=== JWT HEADER ==="
HEADER=$(echo "$TOKEN" | cut -d '.' -f1)
LEN=$(( ${#HEADER} % 4 ))
if [ $LEN -eq 2 ]; then HEADER="${HEADER}=="; fi
if [ $LEN -eq 3 ]; then HEADER="${HEADER}="; fi
echo "$HEADER" | tr '_-' '/+' | base64 -d 2>/dev/null | jq

echo
echo "=== JWT PAYLOAD ==="
PAYLOAD=$(echo "$TOKEN" | cut -d '.' -f2)
LEN=$(( ${#PAYLOAD} % 4 ))
if [ $LEN -eq 2 ]; then PAYLOAD="${PAYLOAD}=="; fi
if [ $LEN -eq 3 ]; then PAYLOAD="${PAYLOAD}="; fi
echo "$PAYLOAD" | tr '_-' '/+' | base64 -d 2>/dev/null | jq

echo
echo "=== INTROSPECTION ==="
curl -s -k \
  -u "${CLIENT_ID}:${CLIENT_SECRET}" \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d "token=$TOKEN" \
  "$INTROSPECT_URL" | jq