OpenID Connect & OAuth2

Atlas is a standards-compliant OpenID Provider — "Sign in with Atlas." Third-party (and first-party) apps you register as OAuth clients run the standard flows against these endpoints. Issuer is your instance host; signing is RS256; PKCE is S256.

Core endpoints

GET|POST /oauth2/authorize          → authorization endpoint (exact redirect_uri match, PKCE for public clients); returns a single-use code
POST     /oauth2/authorize/consent  → consent screen submit (re-derives client/scope from the signed token)
POST     /oauth2/token              → authorization_code, refresh_token (rotated, theft-detected), client_credentials, device_code
GET      /oauth2/userinfo           → sub + profile/email claims filtered by granted scope (Bearer access token)
POST     /oauth2/introspect         → RFC 7662 token introspection (client-authenticated)
POST     /oauth2/revoke             → RFC 7009 token revocation (client-authenticated)

Grants supported at /oauth2/token: authorization_code (single-use, PKCE-verified), refresh_token (rotated with theft detection), client_credentials, and device_code.

Advanced flows

POST /oauth2/par                       → Pushed Authorization Request (RFC 9126): lodge a request, get a request_uri
POST /oauth2/backchannel_authentication→ CIBA (out-of-band user approval); returns an auth_req_id to poll
POST /oauth2/device_authorization      → Device Authorization (RFC 8628): device_code + user_code + verification URIs
GET  /oauth2/device                    → device verification page (approve/deny)
POST /oauth2/device/verify             → device verification submit

RP-initiated logout

GET|POST /oauth2/logout   → end_session_endpoint: verifies id_token_hint, revokes the hosted session,
                            fires Back-/Front-Channel Logout to other RPs, redirects only to an exact-match
                            registered post_logout_redirect_uri

Dynamic Client Registration

See Dynamic Client Registration for POST /oauth2/register (RFC 7591) and the RFC 7592 management endpoints.

Example: authorization code + PKCE

1. Redirect the browser to:
   /oauth2/authorize?response_type=code&client_id=…&redirect_uri=…&scope=openid%20profile%20email
     &code_challenge=…&code_challenge_method=S256&state=…

2. Exchange the returned code:
   POST /oauth2/token
     grant_type=authorization_code&code=…&redirect_uri=…&client_id=…&code_verifier=…

3. Call your resource server with the access_token, or fetch claims:
   GET /oauth2/userinfo   Authorization: Bearer <access_token>

Verify access tokens either by introspection (/oauth2/introspect) or locally against the JWKS.