Documentation

oauth.work is one identity layer for an app, its enterprise customers, and the AI agents acting on their behalf. Every tenant is a full OpenID Connect provider on its own host, with its own signing key, and every privileged action lands on an audit trail you can query or stream.

These guides are ordered the way most integrations go: get a token working, then add the parts your customers ask for.

Start here

• Quickstart — from nothing to a working authorization-code flow, with a real tenant and a real token.
• Authentication — the three ways a caller proves who it is: API keys on the management API, access tokens on the protocol surface, and session cookies on the hosted screens.
• Errors and rate limits — the error contract, the per-endpoint limits, and the headers that tell you where you are against them.
• API reference — every endpoint, generated from the same OpenAPI document the platform serves at /openapi.json.

Agents

• MCP authorization — scoped, consented OAuth 2.1 access tokens for MCP servers and the agents that call them, instead of a shared API key.
• A2A delegation — on-behalf-of tokens between agents, narrowed at every hop.
• Agent identity — registering agents, per-agent tool scopes, secret rotation, and DID-bound agent credentials.
• DPoP — sender-constrained tokens, so a stolen token is useless off the client that earned it.

Sign-in

• OIDC + OAuth 2.1 — the authorization-code flow with PKCE, discovery, and userinfo.
• Login methods — email codes, magic links, passwords, and social sign-in.
• Passkeys — WebAuthn as a first factor or a second.
• TOTP MFA — authenticator apps and recovery codes.
• Sessions and logout — listable, revocable sessions and admin force-logout.
• Bot and abuse protection — the policy gating the login surface.

Enterprise SSO

• OIDC federation — broker a customer’s login to their own identity provider.
• SAML 2.0 — enterprise single sign-on, including IdP-initiated.
• SCIM 2.0 — directory sync, so joiners and leavers arrive without a support ticket.
• Admin Portal — a signed link that lets your customer’s IT admin configure their own SSO, directory sync, and domains.

OAuth in depth

• Client authentication — secrets, private_key_jwt, dynamic registration, and URL client IDs.
• PAR and authorization details — pushed authorization requests and fine-grained authorization_details.
• Token lifecycle — refresh rotation with reuse detection, introspection, revocation.
• Scopes, claims, and discovery — what a token carries and what discovery advertises.

Credentials

• Verifiable Credentials — portable, revocable signed claims about people and agents.
• Issuance and wallets — issuing directly, or via a pre-authorized offer a wallet redeems.
• Revocation and status lists — how a verifier learns a credential was pulled.

Platform

• Multi-tenancy — a tenant per customer, each with its own issuer host, key, and DID.
• Management API — the /v1 surface: conventions, pagination, idempotency.
• Roles and permissions — the permission set, default roles, and API-key scoping.
• Webhooks — signed, retried event delivery.
• Audit logs and events — the queryable trail and the polling cursor feed.
• Audit log streaming — ship the same events to a SIEM.
• Connected accounts — a managed token vault for third-party OAuth.
• Signing keys and rotation — per-tenant keys, JWKS, and rotating without downtime.

Need something that isn’t here? Get in touch.