AAuthpermit
Start free

OAuth 2.0 and OpenID Connect

Endpoints: /oauth/authorize, /oauth/token, /oauth/introspect, /oauth/revoke, /.well-known/openid-configuration, /.well-known/jwks.json.

  • Users: authorization code + PKCE.
  • Applications: client credentials.
  • High security: private_key_jwt and mTLS (enterprise).
  • Scopes mirror platform permissions (identity:verify, credential:verify, …) and tokens may be purpose-bound and resource-bound.

Connect with Authpermit returns verified identity claims to your application after consent.

Sign in with Authpermit (consumer applications)

By default only your organization's active members can sign in through your client (audience: "members"). Register it with audience: "any_account" and any active Authpermit account with a verified email can sign in. Someone who is not a member of your organization gets identity only: the code is cut down to openid, profile, email and authpermit.assurance, and the token carries no permissions in your organization, even if they join it later. The consent screen says "Sign in to your app with your Authpermit account".

Native apps

A public client (confidential: false) may register private-use URI scheme redirects in reverse-DNS form (RFC 8252 §7.1), e.g. com.example.app:/oauth2redirect: lowercase, at least one dot, a single slash after the colon, no fragment. PKCE (S256) is then always required. Confidential clients keep https (or localhost) redirects only. Redirect URIs are matched exactly.

Freshness and assurance

  • prompt=login ends the browser's Authpermit session and asks the person to sign in again before consent.
  • max_age=N does the same when the last sign-in is more than N seconds old.
  • The ID token's auth_time is when the person actually signed in (or last stepped up), not when the token was issued, and stays the same on refreshed ID tokens.
  • acr is the session's authentication assurance level: urn:authpermit:aal1, urn:authpermit:aal2 or urn:authpermit:aal3 (NIST SP 800-63B). amr lists RFC 8176 methods (otp, hwk, user, tel, mfa).
  • acr_values=urn:authpermit:aal2 sends a single-factor session through Authpermit's step-up first. Someone with no second factor gets access_denied. Several values: the weakest one listed is the requirement; unknown values are ignored.