OAuth2 API Reference

Starts the authorization code + PKCE flow. Browser redirect endpoint.

Query Parameters

Param	Required	Description
client_id	Yes	Registered client UUID
response_type	Yes	Must be code
redirect_uri	Yes	Must match a registered URI
code_challenge	Yes	S256 PKCE challenge
code_challenge_method	Yes	Must be S256
scope	No	Space-separated scopes
state	No	Opaque state for CSRF protection

On success, creates a pending authorization challenge (10-min TTL) and redirects 302 to the client's consent_uri with ?challenge={id}.

Token endpoint. Request body is application/x-www-form-urlencoded. Dispatches by grant_type.

grant_type=authorization_code

Field	Required	Description
code	Yes	Authorization code
redirect_uri	Yes	Must match the authorize request
code_verifier	Yes	PKCE verifier (43-128 unreserved chars)
client_id	Public clients	In body for public; via Basic auth for confidential

Returns: { access_token, token_type: "Bearer", expires_in: 3600, scope } plus refresh_token if offline_access was granted.

grant_type=client_credentials

Confidential clients only via HTTP Basic auth. Optional: scope. Returns JWT with sub = client_id. No refresh token.

grant_type=refresh_token

Field	Required	Description
refresh_token	Yes	Current refresh token
client_id	Public clients	Via body or Basic auth

Token rotation: old refresh token revoked, new one issued. Theft detection: replay of a revoked token revokes all tokens for that subject+client.

curl Example

# Authorization code exchange
curl -X POST https://oauth.example.com/oauth2/token \
  -d "grant_type=authorization_code" \
  -d "code=${AUTH_CODE}" \
  -d "redirect_uri=https://app.example.com/callback" \
  -d "code_verifier=${PKCE_VERIFIER}" \
  -d "client_id=${CLIENT_ID}"

# Client credentials
curl -X POST https://oauth.example.com/oauth2/token \
  -u "${CLIENT_ID}:${CLIENT_SECRET}" \
  -d "grant_type=client_credentials" \
  -d "scope=read write"

RFC 7009. Form-encoded body.

Field	Required	Description
token	Yes	Token to revoke (access or refresh)
client_id	Public clients	Via body or Basic auth

Always returns 200 (silent on invalid/unknown tokens per RFC).

RFC 7591. Open registration (no auth required).

Request Body

Field	Required	Description
client_name	Yes	Human-readable client name
client_type	Yes	"confidential" or "public"
redirect_uris	Yes	Array of allowed redirect URIs
consent_uri	Yes	URL of the CAS consent page
consent_jwk	Yes	Public JWK for consent signature verification
scopes	No	Allowed scopes (default: ["offline_access"])

Returns 201 with client details. Confidential clients also receive client_secret (shown once).

The CAS signs each consent submission with the private key corresponding to the client's consent_jwk.

Canonical string: {challenge_id}:{subject}:{scope}:{approved}:{timestamp}:{sha512(claims)}

Supported algorithms: Ed25519 (recommended), EC P-256/P-384/P-521. No RSA.

Replay protection: Timestamp must be within ±60 seconds of server time.