OAuth 2.1 for AI assistants
Dynamic client registration, authorization code with PKCE, tokens and revocation, server metadata. Used by MCP clients; integrations use API keys instead.
Technická reference je anglicky (stejně jako strojově čitelný dokument OpenAPI). Celou skupinu pro AI agenta načtete z /api/openapi.json?tag=OAuth.
Operace
| Metoda | Cesta | Popis |
|---|---|---|
| GET | /.well-known/oauth-authorization-server | Authorization server metadata (RFC 8414) |
| GET | /.well-known/oauth-authorization-server/mcp | Authorization server metadata (RFC 8414) |
| GET | /.well-known/oauth-protected-resource | Protected resource metadata (RFC 9728) |
| GET | /.well-known/oauth-protected-resource/mcp | Protected resource metadata (RFC 9728) |
| GET | /oauth/authorize | Authorization (browser redirect to the consent page) |
| POST | /oauth/register | Dynamic client registration (RFC 7591, at most 20 an hour per address) |
| POST | /oauth/revoke | Revoke a token (RFC 7009) |
| POST | /oauth/token | Tokens: authorization_code or refresh_token (access pso_... 1 hour, refresh psr_... 30 days, rotated) |
Authorization server metadata (RFC 8414)
GET /.well-known/oauth-authorization-server
Bez přihlášení.
Odpovědi
- 200 issuer and endpoints:
application/jsonobject
Authorization server metadata (RFC 8414)
GET /.well-known/oauth-authorization-server/mcp
Bez přihlášení.
Odpovědi
- 200 issuer and endpoints:
application/jsonobject
Protected resource metadata (RFC 9728)
GET /.well-known/oauth-protected-resource
Bez přihlášení.
Odpovědi
- 200 resource, authorization_servers, scopes_supported read and full:
application/jsonobject
Protected resource metadata (RFC 9728)
GET /.well-known/oauth-protected-resource/mcp
Bez přihlášení.
Odpovědi
- 200 resource, authorization_servers, scopes_supported read and full:
application/jsonobject
Authorization (browser redirect to the consent page)
GET /oauth/authorize
Bez přihlášení.
Parametry
| Název | Kde | Typ | Povinné | Popis |
|---|---|---|---|---|
response_type | query | string | ano | |
client_id | query | string | ano | |
redirect_uri | query | string | ano | |
code_challenge | query | string | ano | |
code_challenge_method | query | string | ano | |
scope | query | string | ne | |
state | query | string | ne | |
resource | query | string | ne |
Odpovědi
- 302 To /connect (consent) or back to the client with an error
Dynamic client registration (RFC 7591, at most 20 an hour per address)
POST /oauth/register
Bez přihlášení.
Tělo požadavku (application/json)
| Pole | Typ | Povinné | Popis |
|---|---|---|---|
redirect_uris | array of string | ano | https; http only on loopback; custom schemes only of known native clients. |
client_name | string | ne | |
token_endpoint_auth_method | one of: none, client_secret_post, client_secret_basic | ne |
Odpovědi
- 201 client_id (and client_secret):
application/jsonobject
Chyby
| Stav | Kód | Hodnoty message |
|---|---|---|
| 400 | invalid_redirect_uri or invalid_client_metadata |
Revoke a token (RFC 7009)
POST /oauth/revoke
Bez přihlášení.
Tělo požadavku (application/x-www-form-urlencoded)
| Pole | Typ | Povinné | Popis |
|---|---|---|---|
token | string | ano | |
token_type_hint | string | ne |
Odpovědi
- 200 Revoked (also for an unknown token)
Tokens: authorization_code or refresh_token (access pso_... 1 hour, refresh psr_... 30 days, rotated)
POST /oauth/token
Bez přihlášení.
Tělo požadavku (application/x-www-form-urlencoded)
| Pole | Typ | Povinné | Popis |
|---|---|---|---|
grant_type | string | ano | |
code | string | ne | |
redirect_uri | string | ne | |
code_verifier | string | ne | |
refresh_token | string | ne | |
client_id | string | ne | |
client_secret | string | ne | |
resource | string | ne |
Odpovědi
- 200 access_token, token_type Bearer, expires_in, refresh_token, scope:
application/jsonobject
Chyby
| Stav | Kód | Hodnoty message |
|---|---|---|
| 400 | invalid_grant, invalid_request ... |