Orbit OAuth2
Standards-compliant token issuance. Orbit OAuth2 is a headless authorization server implementing OAuth 2.0 with PKCE-enforced authorization code flows, ES512-signed JWTs, automatic key rotation, and refresh token theft detection — all out of the box.
Key Capabilities
Authorization Code + PKCE
S256 challenge method enforced on every flow. plain is disabled. Public and confidential clients supported. 5-minute code TTL, single-use.
ES512 JWT Access Tokens
Signed with EC P-521. 1-hour TTL. Standard claims: iss, sub, aud, scope, client_id, jti. JWKS endpoint for verification.
Refresh Token Rotation
Single-use refresh tokens (7-day TTL). On each use, the old token is revoked and a new one is issued. Replay of a revoked token triggers revocation of all tokens for that subject+client.
Pluggable Consent (CAS)
Each client specifies its own consent_uri and consent_jwk. The CAS authenticates the user, collects consent, and posts a signed decision. orbit-oauth2 never serves HTML.
Headless by Design
Orbit OAuth2 is a pure protocol engine. It issues no HTML, performs no user authentication, and stores no passwords. User login and consent are the responsibility of a registered CAS (Central Authentication Service). For Orbit's own management clients, orbit-dash serves as the CAS, signing consent payloads with Ed25519.
Security Model
- Client secrets — stored as SHA-512 hex hashes. Raw secret shown once at creation.
- Signing keys — EC P-521 private keys encrypted at rest with AES-256-GCM.
- Consent verification — per-request asymmetric signature. Supported: Ed25519, EC P-256/P-384/P-521. Timestamp replay window: ±60 seconds.
- Zero consent-key liability — orbit-oauth2 stores only the public JWK; the private key never leaves the CAS.
Grant Types
| Grant Type | Client Type | Refresh Token | Use Case |
|---|---|---|---|
authorization_code | Public or confidential | Only if offline_access | User-facing applications |
client_credentials | Confidential only | No | Machine-to-machine / service accounts |
refresh_token | Public or confidential | Yes (rotated) | Extending user sessions |
Discovery & JWKS
Standard RFC 8414 metadata at
/.well-known/oauth-authorization-server. Public signing keys at /.well-known/jwks.json
(also aliased at /oauth2/certificates).