Skip to content
Search
Ctrl
K
Cancel
oauth.work
Select theme
Dark
Light
Auto
Start here
Overview
Quickstart
Authentication
Errors and rate limits
Agents
Agent discovery
MCP authorization
A2A delegation
Agent identity
DPoP
Sign-in
OIDC + OAuth 2.1
Login methods
Passkeys (WebAuthn)
TOTP MFA
Sessions and logout
Bot and abuse protection
Enterprise SSO
OIDC federation
Identity chaining (ID-JAG)
SAML 2.0
SCIM 2.0
Admin Portal
OAuth in depth
Client authentication
PAR and authorization details
Token lifecycle
Scopes, claims, and discovery
Credentials
Verifiable Credentials
Issuance and wallets
Revocation and status lists
Platform
Multi-tenancy
Management API
Roles and permissions
Webhooks
Audit logs and events
Audit log streaming
Connected accounts
Signing keys and rotation
API reference
Overview
OIDC
Overview
OpenID Provider / Authorization Server metadata (RFC 8414)
JSON Web Key Set (public signing keys)
UserInfo endpoint
OAuth
Overview
Authorization endpoint (auth-code + PKCE S256)
Pushed Authorization Request (RFC 9126)
Token endpoint (authorization_code, refresh_token, client_credentials, token-exchange)
Token revocation (RFC 7009)
Token introspection (RFC 7662)
Dynamic Client Registration (RFC 7591)
Credentials
Overview
Verify a Verifiable Credential
Issue a Verifiable Credential to the token's subject
Verify a Verifiable Presentation (OID4VP, SD-JWT VC)
OID4VCI Credential Endpoint
OID4VCI Credential Issuer metadata
DID document (tenant-aware did:web)
Bitstring Status List credential (revocation)
List issued credentials (cursor-paginated)
Issue a Verifiable Credential for the org
Revoke a credential (flips its status-list bit)
Create an OID4VCI pre-authorized credential offer for a user
Management
Overview
Create an organization (platform-admin key)
Get an organization
Update organization branding fields
Export organization configuration (no secrets)
Set WebAuthn AAGUID allowlist
List an org's API keys (metadata only)
Mint an API key for an org
Revoke an API key
List an org's members with roles
Add a member with a role
Remove a member
Change a member's role
List issued credentials (cursor-paginated)
Issue a Verifiable Credential for the org
Revoke a credential (flips its status-list bit)
Create an OID4VCI pre-authorized credential offer for a user
List an org's agents (no secret material)
Register an agent (A2A/MCP) with scoped tool permissions
Delete an agent
Rotate an agent's client secret (old secret invalidated)
List webhook endpoints (no signing secrets)
Register a signed webhook endpoint
Delete a webhook endpoint
List the org's domains
Add a domain (returns the DNS TXT challenge)
Verify a domain's DNS TXT record
List SSO connections
Create an inbound SSO connection (OIDC/SAML)
List trusted identity providers
Trust an identity provider for the ID-JAG identity-chaining grant
Stop trusting an identity provider
Rotate the org's signing key
List token-vault providers (no secrets)
Register a token-vault provider (third-party OAuth app)
Delete a token-vault provider
List connected accounts (no token material)
Retrieve a live access token from the vault
Disconnect an account (revokes stored tokens)
List audit log streams
Create an audit log stream (SIEM delivery)
Delete an audit log stream
List a user's active sessions
Force logout: revoke all of a user's sessions
Mint a signed Admin Portal link
Mint a SCIM bearer token for directory sync
Query the tenant audit log
Events feed (ascending, cursor-paginated)
SCIM
Overview
SCIM service provider configuration
List/filter users
Provision a user
Get a user
Replace a user
Deprovision a user
Patch a user (e.g. activate/deactivate)
List/filter groups
Create a group
Get a group
Replace a group
Delete a group
Patch group membership
SAML
Overview
SP metadata (EntityDescriptor XML)
Assertion Consumer Service
WebAuthn
Overview
Begin passkey registration
Complete passkey registration
Begin passkey authentication
Complete passkey authentication
oauth.work
Select theme
Dark
Light
Auto
Overview
SAML
Section titled “SAML”
Inbound SAML 2.0 SSO (SP)