OAuth provider guide

Register a client and run the complete token flow.

Daptin issues tokens to registered applications. This is separate from connecting Daptin to an upstream provider such as Google or GitHub.

Authorization code
PKCE required
OIDC discovery

Why run the provider →

Allow the exact application callback.

curl -X POST http://localhost:6336/action/oauth_app/register_client \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"attributes":{
    "name":"Example Client",
    "redirect_uris":"https://client.example.com/callback",
    "scopes":"openid profile email",
    "grants":"authorization_code,refresh_token",
    "is_confidential":true
  }}'

Store the returned client secret immediately; registration and secret rotation return it once. HTTPS is required for non-localhost redirects, wildcards and URI fragments are rejected, and the authorization request must match a registered URI exactly.

Authorization

Use authorization code with PKCE.

Create a high-entropy code_verifier and its base64url SHA-256 challenge.
Send the user to /oauth/authorize with the client, exact redirect URI, allowed scopes, state, challenge, method S256, and an OIDC nonce when needed.
After sign-in, compare the returned state before accepting the authorization code.
Exchange the code at /oauth/token with the same redirect URI and original verifier.
Use the access token, then rotate access through the refresh-token grant.

PKCE is required. Daptin also reports plain support for compatibility, but new clients should use S256.

Provider endpoints

Give clients the metadata and checks they expect.

Discovery

/.well-known/openid-configuration and the OAuth metadata endpoint describe the issuer and supported endpoints.

UserInfo and JWKS

/oauth/userinfo returns permitted identity claims; /oauth/jwks publishes public RS256 signing keys.

Introspection

/oauth/introspect lets an authorized confidential client check whether an access token is active.

Revocation

/oauth/revoke invalidates access or refresh tokens. Client-management actions can revoke all tokens for one application.

Security verification

Test invalid OAuth flows.

An unregistered redirect URI returns an error and is not used as an error redirect.
Missing PKCE, the wrong verifier, an unapproved scope, and a disabled client all fail.
An authorization code succeeds once and fails on replay.
A refresh rotates the issued token material and old revoked tokens introspect as inactive.
UserInfo returns the intended subject and allowed claims.
JWKS exposes the public key required to validate the current ID token.
Client disabling and client-wide token revocation take effect.
The implicit and client-credentials grants are not presented as supported flows.

Connect a real client and test replay.

Return to OAuth provider →Authentication guide ↗