Endpoints
Every provider endpoint. You do not need to configure them — this is for reference.
Your library takes everything from here:
https://auth.my/.well-known/openid-configuration
The same document is served at the RFC 8414 address —
/.well-known/oauth-authorization-server — for clients that do not know
about OpenID Connect.
The list
| What | Address | Method |
|---|---|---|
| issuer | https://auth.my | — |
| authorization | /auth | GET |
| code exchange and refresh | /token | POST |
| user data | /me | GET |
| signing keys | /jwks | GET |
| sign-out | /session/end | GET |
| token revocation | /token/revocation | POST |
| token introspection | /token/introspection | POST |
Client authentication
A confidential client presents its secret in an
Authorization: Basic base64(client_id:client_secret) header — that is -u
in curl.
A public client has no secret and sends client_id in the request body.
What is supported
| Parameter | Values |
|---|---|
response_type | code |
grant_type | authorization_code, refresh_token |
code_challenge_method | S256 (mandatory) |
id_token signing | RS256 by default, ES256 on request |
scope | openid, profile, email, phone, offline_access |
The implicit flow, the password grant and plain PKCE are deliberately not
supported: all three are considered unsafe and are excluded from current
recommendations.
Browser requests
A single-page application may call us from the origins listed in its redirect URIs. You do not need to ask us to open CORS; other origins are refused.
Rate limiting
Code entry and sign-in attempts are rate limited. A normal authorization flow does not hit the limit; brute forcing does.