Standard and Custom OAuth 2.0 and OpenId Connect Endpoints
Authway supports the following standard and custom OAuth 2.0 and OpenId Connect endpoints:
| Endpoint | Description |
|---|---|
| Discovery | Exposes metadata about the OAuth 2.0 and OpenId Connect endpoints, capabilities and extensions. |
| JWK set | Get the published JSON Web Key (JWK) set to verify the signature of an issued token or to encrypt request objects that is passed to the server. |
| Authorization | Authenticate the end-user by sending their browser to the authorization endpoint. |
| Pushed Authorization Request (PAR) | Pass the request parameters in a backchannel directly to the server before sending the user’s browser to the authorization endpoint. |
| Token | Pass an OAuth 2.0 grant, such as code, refresh token or client credentials, to get an Id token and/or access token. |
| Token introspection | Validate and get the real access token for a reference token. |
| Token revocation | Revoke a refresh or access token. |
| UserInfo | Fetch user information that is not in the token. |
| Check Session iframe | Check the identity provider for changes of the end-user authentication. |
| Logout (end-session) | Sign-out the end-user by sending their browser to the logout endpoint. |
| Scope introspection | Custom endpoint that allows a client or API resource to fetch extra scopes for a user through a backchannel. |