OAuth2
OAuth2 protocol endpoints (RFC 6749, 7009, 7662, 8628, 8693, 9126).
Endpoints
- OAuth2 / OIDC authorization endpointGET
/authorizeStarts the authorization-code flow (RFC 6749 §4.1, OIDC Core). PKCE is required for public clients and enforced for all per RFC 9700; the code_challenge is bound to the code and verified at the token endpoint. - OAuth2 / OIDC authorization endpoint (POST form)POST
/authorizeThe POST form of the authorization endpoint. OIDC Core §3.1.2.1: "The Authorization Server MUST support the use of the HTTP GET and POST methods defined in RFC 7231 at the Authorization Endpoint." RFC 6749 §3.1 says the same. - Pushed Authorization Request (RFC 9126)POST
/parAccepts the authorization-request parameters directly from a client-authenticated back channel and returns a single-use request_uri the client then passes to /authorize. Hardens the flow against request tampering and oversized front-channel requests. request_uri MUST NOT be present in the PAR body. - OAuth2 token endpointPOST
/tokenExchanges a grant for tokens (RFC 6749 §4). Supported grant types: authorization_code (with PKCE), refresh_token (rotated for public clients per RFC 9700), client_credentials, urn:ietf:params:oauth:grant-type:device_code (RFC 8628), urn:ietf:params:oauth:grant-type:token-exchange (RFC 8693), and urn:ietf:params:oauth:grant-type:jwt-bearer (RFC 7523). - Device Authorization Request (RFC 8628)POST
/device_authorizationBegins the device authorization grant for browserless / input-constrained clients. Returns a device_code, a user-facing user_code, and a verification_uri; the client then polls /token with grant_type=urn:ietf:params:oauth:grant-type:device_code. - OAuth2 token introspection (RFC 7662)POST
/introspectReturns the active state and metadata of a token to a resource server. The caller (a protected resource or confidential client) authenticates via client_secret_basic, client_secret_post, or private_key_jwt. - OAuth2 token revocation (RFC 7009)POST
/revokeRevokes an access or refresh token. Always returns 200 to the client (even for an unknown token) so revocation cannot be used as an oracle.