GET /oauth2/authorize

Authorization endpoint. Exact redirect_uri match, PKCE for public clients; authenticates via the hosted session and returns a single-use code.

POST /oauth2/authorize

Authorization endpoint (form post). Exact redirect_uri match, PKCE for public clients; returns a single-use code.

POST /oauth2/authorize/consent

Consent screen submit. Re-derives client, redirect_uri and scope from the signed token and the stored client (never the POST); approve records consent and mints a code, deny redirects access_denied.

POST /oauth2/token

Token endpoint. authorization_code (single-use, PKCE-verified), refresh_token (rotated, theft-detected), client_credentials and device_code grants; mints access, id and refresh tokens.

POST /oauth2/par

Pushed Authorization Request (RFC 9126). Client-authenticated; lodges a validated authorization request and returns a single-use, client-bound request_uri for /authorize.

POST /oauth2/backchannel_authentication

CIBA backchannel authentication (OpenID Client-Initiated Backchannel Auth). Confidential client requests out-of-band user approval; returns an auth_req_id to poll /token with.

POST /oauth2/device_authorization

Device Authorization endpoint (RFC 8628). Client-authenticated; returns a device_code, a user_code and the verification URIs for the "log in on a TV" flow.

GET /oauth2/device

Device verification page (RFC 8628). Requires a hosted session; with a user_code it renders an approve/deny screen carrying a signed, session-bound token, else the code-entry form.

POST /oauth2/device/verify

Device verification submit. Re-derives the device code from the signed session-bound token; approve binds the signed-in user and records consent, deny marks the code denied.

POST /oauth2/register

Dynamic Client Registration (RFC 7591). Gated by the per-instance oauthProvider.dynamicRegistration flag (403 when off); validates https/localhost redirect_uris and returns the new client_id and, for confidential clients, a secret.

GET /oauth2/register/:clientId

Read a dynamically-registered client’s configuration (RFC 7592). Authenticated by the registration_access_token issued at registration.

PUT /oauth2/register/:clientId

Update a dynamically-registered client’s configuration (RFC 7592), authenticated by its registration_access_token.

DELETE /oauth2/register/:clientId

Delete a dynamically-registered client (RFC 7592), authenticated by its registration_access_token.

GET /oauth2/logout

RP-Initiated Logout end_session_endpoint (OIDC). Verifies the id_token_hint signature, revokes the end-user hosted session, fires Back-Channel and Front-Channel Logout to other RPs, and redirects only to an exact-match registered post_logout_redirect_uri.

POST /oauth2/logout

RP-Initiated Logout end_session_endpoint (form post). Verifies the id_token_hint, revokes the hosted session, notifies other RPs (Back-/Front-Channel Logout), and redirects only to an exact-match registered post_logout_redirect_uri.

GET /oauth2/userinfo

UserInfo endpoint. Returns sub plus profile and email claims filtered by the granted scope, for a Bearer access token; refuses a token whose grant has been revoked.

POST /oauth2/revoke

Token revocation (RFC 7009). Client-authenticated; revokes the grant behind a refresh or access token. Always 200 for a well-formed request; only the owning client revokes anything.

POST /oauth2/introspect

Token introspection (RFC 7662). Client-authenticated; returns active:true with the token metadata for a live, non-revoked token owned by the caller, else {active:false}.