OAuth 2.1 for AI assistants
Dynamic client registration, authorization code with PKCE, tokens and revocation, server metadata. Used by MCP clients; integrations use API keys instead.
Technická referencia je v angličtine (rovnako ako strojovo čitateľný dokument OpenAPI). Celú skupinu pre AI agenta načítate z /api/openapi.json?tag=OAuth.
Operácie
| Metóda | Cesta | Popis |
|---|---|---|
| GET | /.well-known/oauth-authorization-server | Authorization server metadata (RFC 8414) |
| GET | /.well-known/oauth-authorization-server/mcp | Authorization server metadata (RFC 8414) |
| GET | /.well-known/oauth-protected-resource | Protected resource metadata (RFC 9728) |
| GET | /.well-known/oauth-protected-resource/mcp | Protected resource metadata (RFC 9728) |
| GET | /oauth/authorize | Authorization (browser redirect to the consent page) |
| POST | /oauth/register | Dynamic client registration (RFC 7591, at most 20 an hour per address) |
| POST | /oauth/revoke | Revoke a token (RFC 7009) |
| POST | /oauth/token | Tokens: authorization_code or refresh_token (access pso_... 1 hour, refresh psr_... 30 days, rotated) |
Authorization server metadata (RFC 8414)
GET /.well-known/oauth-authorization-server
Bez prihlásenia.
Odpovede
- 200 issuer and endpoints:
application/jsonobject
Authorization server metadata (RFC 8414)
GET /.well-known/oauth-authorization-server/mcp
Bez prihlásenia.
Odpovede
- 200 issuer and endpoints:
application/jsonobject
Protected resource metadata (RFC 9728)
GET /.well-known/oauth-protected-resource
Bez prihlásenia.
Odpovede
- 200 resource, authorization_servers, scopes_supported read and full:
application/jsonobject
Protected resource metadata (RFC 9728)
GET /.well-known/oauth-protected-resource/mcp
Bez prihlásenia.
Odpovede
- 200 resource, authorization_servers, scopes_supported read and full:
application/jsonobject
Authorization (browser redirect to the consent page)
GET /oauth/authorize
Bez prihlásenia.
Parametre
| Názov | Kde | Typ | Povinné | Popis |
|---|---|---|---|---|
response_type | query | string | áno | |
client_id | query | string | áno | |
redirect_uri | query | string | áno | |
code_challenge | query | string | áno | |
code_challenge_method | query | string | áno | |
scope | query | string | nie | |
state | query | string | nie | |
resource | query | string | nie |
Odpovede
- 302 To /connect (consent) or back to the client with an error
Dynamic client registration (RFC 7591, at most 20 an hour per address)
POST /oauth/register
Bez prihlásenia.
Telo požiadavky (application/json)
| Pole | Typ | Povinné | Popis |
|---|---|---|---|
redirect_uris | array of string | áno | https; http only on loopback; custom schemes only of known native clients. |
client_name | string | nie | |
token_endpoint_auth_method | one of: none, client_secret_post, client_secret_basic | nie |
Odpovede
- 201 client_id (and client_secret):
application/jsonobject
Chyby
| Stav | Kód | Hodnoty message |
|---|---|---|
| 400 | invalid_redirect_uri or invalid_client_metadata |
Revoke a token (RFC 7009)
POST /oauth/revoke
Bez prihlásenia.
Telo požiadavky (application/x-www-form-urlencoded)
| Pole | Typ | Povinné | Popis |
|---|---|---|---|
token | string | áno | |
token_type_hint | string | nie |
Odpovede
- 200 Revoked (also for an unknown token)
Tokens: authorization_code or refresh_token (access pso_... 1 hour, refresh psr_... 30 days, rotated)
POST /oauth/token
Bez prihlásenia.
Telo požiadavky (application/x-www-form-urlencoded)
| Pole | Typ | Povinné | Popis |
|---|---|---|---|
grant_type | string | áno | |
code | string | nie | |
redirect_uri | string | nie | |
code_verifier | string | nie | |
refresh_token | string | nie | |
client_id | string | nie | |
client_secret | string | nie | |
resource | string | nie |
Odpovede
- 200 access_token, token_type Bearer, expires_in, refresh_token, scope:
application/jsonobject
Chyby
| Stav | Kód | Hodnoty message |
|---|---|---|
| 400 | invalid_grant, invalid_request ... |