OAuth2

Docs version v1 (main) · Nauthera is pre-1.0, in a design-partner program

Endpoints

• OAuth2 / OIDC authorization endpointGET/authorizeStarts the authorization-code flow (RFC 6749 §4.1, OIDC Core). PKCE is required for public clients and enforced for all per RFC 9700; the code_challenge is bound to the code and verified at the token endpoint.
• OAuth2 / OIDC authorization endpoint (POST form)POST/authorizeThe POST form of the authorization endpoint. OIDC Core §3.1.2.1: "The Authorization Server MUST support the use of the HTTP GET and POST methods defined in RFC 7231 at the Authorization Endpoint." RFC 6749 §3.1 says the same.
• Pushed Authorization Request (RFC 9126)POST/parAccepts the authorization-request parameters directly from a client-authenticated back channel and returns a single-use request_uri the client then passes to /authorize. Hardens the flow against request tampering and oversized front-channel requests. request_uri MUST NOT be present in the PAR body.
• OAuth2 token endpointPOST/tokenExchanges a grant for tokens (RFC 6749 §4). Supported grant types: authorization_code (with PKCE), refresh_token (rotated for public clients per RFC 9700), client_credentials, and urn:ietf:params:oauth:grant-type:device_code (RFC 8628).
• Device Authorization Request (RFC 8628)POST/device_authorizationBegins the device authorization grant for browserless / input-constrained clients. Returns a device_code, a user-facing user_code, and a verification_uri; the client then polls /token with grant_type=urn:ietf:params:oauth:grant-type:device_code.
• OAuth2 token introspection (RFC 7662)POST/introspectReturns the active state and metadata of a token to a resource server. The caller (a protected resource or confidential client) authenticates via client_secret_basic, client_secret_post, or private_key_jwt.
• OAuth2 token revocation (RFC 7009)POST/revokeRevokes an access or refresh token. Always returns 200 to the client (even for an unknown token) so revocation cannot be used as an oracle.