Authorization Server · Reference

OAuth Reference & Endpoints

Every OAuth 2.0 / OIDC endpoint this server exposes, in one place — your live session, discovery, JWKS, tokens, and Swagger. New to OAuth? Start with a guided path in the OAuth Learning Portal.

Authorization Server Session

Checking…
Status…
Current User…
Session…
Authentication MethodAuthorization Server Session Cookie (pw_as_session)

Live from GET /api/oauth/as/session. Current User is your OIDC subject identifier (the stable, pseudonymous sub) — the same value ID tokens and UserInfo use to identify you. This resource-owner session is deliberately separate from the practice-site login and the CineVerse session — three isolated auth systems.

Available Endpoints

Every one of these is a real route on this server. JSON endpoints open in a new tab.

Discovery OIDC configuration document clients read to auto-discover every endpoint and capability. /.well-known/openid-configuration OAuth Metadata Authorization Server metadata as defined by RFC 8414. /.well-known/oauth-authorization-server JWKS JSON Web Key Set — the public keys used to verify token signatures. /oauth/jwks UserInfo OIDC claims for a valid access token. Without a Bearer token it returns 401 — a useful lesson. /oauth/userinfo Authorize The Authorization Endpoint that starts the Authorization Code flow. /oauth/authorize Token / Introspect / Revoke POST endpoints for exchanging codes, inspecting and revoking tokens — try them in Swagger. /oauth/token · /oauth/introspect · /oauth/revoke AS Session Reports whether your Authorization Server session cookie is currently valid. /api/oauth/as/session Swagger / API Docs Browse and try every OAuth API interactively. /api-docs

Learn the Authorization Code Flow

The sequence every card above participates in. Each step maps to a real endpoint on this server.

Step 1
Authorization Request
GET /oauth/authorize
→
Step 2
Authorization Code
redirect_uri?code=…
→
Step 3
Access + ID Token
POST /oauth/token
→
Step 4
UserInfo
GET /oauth/userinfo
→
Step 5
Refresh
POST /oauth/token (grant=refresh)
Open Developer Console Open Flow Inspector

See it as an Identity Provider — CineVerse

CineVerse is a separate application that uses this Authorization Server to sign users in. Launch it to watch the Authorization Code flow happen for real between two apps — the clearest way to understand external vs. internal identity providers.

Launch CineVerse using OAuth