Endpoints
All OpenID Connect endpoints live under the issuer, https://accounts.webrizen.com/api/auth.
Libraries find them automatically from the discovery document.
Reference
| Endpoint | Path | Purpose |
|---|---|---|
| Discovery | /.well-known/openid-configuration | Machine-readable list of everything below |
| Authorization | /oauth2/authorize | Starts sign-in (browser redirect) |
| Token | /oauth2/token | Exchanges codes and refresh tokens for tokens |
| UserInfo | /oauth2/userinfo | Current profile + org for an access token |
| JWKS | /jwks | Public keys for verifying ID tokens |
| Introspection | /oauth2/introspect | Backend check: is this token active, and whose is it? |
| Revocation | /oauth2/revoke | Invalidate an access or refresh token |
| End session | /oauth2/end-session | Global sign-out, then redirect to a registered URI |
| Directory | /directory/members | List an organization's members with an app token. See Directory API |
Supported values
| Discovery field | Values |
|---|---|
response_types_supported | code |
grant_types_supported | authorization_code, refresh_token, client_credentials |
code_challenge_methods_supported | S256 |
id_token_signing_alg_values_supported | RS256 |
token_endpoint_auth_methods_supported | client_secret_basic, client_secret_post, private_key_jwt |
prompt_values_supported | login, consent, create, select_account, none |
Useful prompt values
| Prompt | Behaviour |
|---|---|
| (none) | Silent if already signed in, otherwise show sign-in |
login | Always ask for credentials again, e.g. before a sensitive action |
select_account | Let the user choose their organization again |
create | Open the sign-up page instead of sign-in |
none | Never show UI. Returns an error if the user isn't signed in (good for "am I signed in?" checks) |
Examples
Userinfo
curl -H "Authorization: Bearer ACCESS_TOKEN" \
https://accounts.webrizen.com/api/auth/oauth2/userinfoRefresh
curl -u CLIENT_ID:CLIENT_SECRET https://accounts.webrizen.com/api/auth/oauth2/token \
-d grant_type=refresh_token -d refresh_token=REFRESH_TOKENIntrospection (from your backend)
curl -u CLIENT_ID:CLIENT_SECRET https://accounts.webrizen.com/api/auth/oauth2/introspect \
-d token=ACCESS_TOKENApp token (client credentials, for the Directory API)
curl -u CLIENT_ID:CLIENT_SECRET https://accounts.webrizen.com/api/auth/oauth2/token \
-d grant_type=client_credentials -d scope=members:readGlobal sign-out
https://accounts.webrizen.com/api/auth/oauth2/end-session
?client_id=CLIENT_ID
&id_token_hint=ID_TOKEN
&post_logout_redirect_uri=https://restaurant.webrizen.comNote
post_logout_redirect_uri must be one of the app's registered sign-out redirect URIs.