OAuth reference

Endpoints, discovery documents, parameters and token lifetimes.

Discovery

Document
URL


OpenID Connect discovery
https://auth.amped.bio/.well-known/openid-configuration

OAuth authorization server metadata
https://auth.amped.bio/.well-known/oauth-authorization-server

Protected resource metadata (MCP)
https://api.amped.bio/.well-known/oauth-protected-resource/mcp

JSON Web Key Set
https://auth.amped.bio/.well-known/jwks.json

Document	URL
OpenID Connect discovery	`https://auth.amped.bio/.well-known/openid-configuration`
OAuth authorization server metadata	`https://auth.amped.bio/.well-known/oauth-authorization-server`
Protected resource metadata (MCP)	`https://api.amped.bio/.well-known/oauth-protected-resource/mcp`
JSON Web Key Set	`https://auth.amped.bio/.well-known/jwks.json`

The issuer is https://auth.amped.bio.

Endpoints

All OAuth/OIDC endpoints are served from the auth.amped.bio subdomain. Replace the host with localhost:44000 for local development.

Endpoint
Path
Notes


Authorization
/oauth2/authorize
response_type=code only, PKCE S256

Token
/oauth2/token
authorization_code, refresh_token, client_credentials, device grant

Consent
/oauth2/consent
Used by our hosted consent screen

UserInfo
/oauth2/userinfo
Requires the openid scope

Introspection
/oauth2/introspect
RFC 7662, client authentication required

Revocation
/oauth2/revoke
RFC 7009

Dynamic registration
/oauth2/register
Enabled for machine clients with an initial access token

Client management
/oauth2/create-client, /oauth2/get-clients, /oauth2/update-client, /oauth2/delete-client, /oauth2/client/rotate-secret
Session authenticated

Device authorization
/device/code, /device/token
RFC 8628

Device approval page
/oauth/device
Redirects to the hosted approval page

Endpoint	Path	Notes
Authorization	`/oauth2/authorize`	`response_type=code` only, PKCE `S256`
Token	`/oauth2/token`	`authorization_code`, `refresh_token`, `client_credentials`, device grant
Consent	`/oauth2/consent`	Used by our hosted consent screen
UserInfo	`/oauth2/userinfo`	Requires the `openid` scope
Introspection	`/oauth2/introspect`	RFC 7662, client authentication required
Revocation	`/oauth2/revoke`	RFC 7009
Dynamic registration	`/oauth2/register`	Enabled for machine clients with an initial access token
Client management	`/oauth2/create-client`, `/oauth2/get-clients`, `/oauth2/update-client`, `/oauth2/delete-client`, `/oauth2/client/rotate-secret`	Session authenticated
Device authorization	`/device/code`, `/device/token`	RFC 8628
Device approval page	`/oauth/device`	Redirects to the hosted approval page

Authorization request

Parameter
Required
Notes


client_id
yes


redirect_uri
yes
Exact match against the registered URIs

response_type
yes
code

scope
no
Space separated; defaults to the client's registered scopes

state
recommended
Echoed back, use it to prevent CSRF

code_challenge / code_challenge_method
yes for public clients
S256 only

nonce
recommended for OIDC
Included in the ID token

prompt
no
login, consent, create, select_account, none

resource
no
RFC 8707 protected resource identifier, required to receive a resource bound token

Parameter	Required	Notes
`client_id`	yes
`redirect_uri`	yes	Exact match against the registered URIs
`response_type`	yes	`code`
`scope`	no	Space separated; defaults to the client's registered scopes
`state`	recommended	Echoed back, use it to prevent CSRF
`code_challenge` / `code_challenge_method`	yes for public clients	`S256` only
`nonce`	recommended for OIDC	Included in the ID token
`prompt`	no	`login`, `consent`, `create`, `select_account`, `none`
`resource`	no	RFC 8707 protected resource identifier, required to receive a resource bound token

The authorization response always includes iss (RFC 9207) so clients can detect mix-up attacks.

Client authentication

Method
When to use


client_secret_basic
Confidential clients (default)

client_secret_post
Confidential clients that cannot send Authorization headers

private_key_jwt
Confidential clients using asymmetric keys

none
Public clients (SPAs, mobile apps, CLIs) with PKCE

Method	When to use
`client_secret_basic`	Confidential clients (default)
`client_secret_post`	Confidential clients that cannot send Authorization headers
`private_key_jwt`	Confidential clients using asymmetric keys
`none`	Public clients (SPAs, mobile apps, CLIs) with PKCE

Token lifetimes

Token
Lifetime


Authorization code
10 minutes

Access token
15 minutes (per resource policy when a resource is requested)

ID token
10 hours

Refresh token
30 days, rotated on every use

Token	Lifetime
Authorization code	10 minutes
Access token	15 minutes (per resource policy when a `resource` is requested)
ID token	10 hours
Refresh token	30 days, rotated on every use

Because access tokens are stateless JWTs they cannot be revoked individually: end the session by revoking the refresh token, and keep lifetimes short.

Errors

Authorization errors are returned to your redirect_uri as error and error_description. Token endpoint errors use the OAuth taxonomy (invalid_request, invalid_client, invalid_grant, invalid_scope, invalid_target) with an appropriate HTTP status.