Core Endpoints

Direct API references for the Kotha Auth core OIDC implementation.

Discovery & Keys

  • GET /.well-known/openid-configuration - OIDC Discovery metadata
  • GET /.well-known/jwks.json - JSON Web Key Set for verifying JWTs

OAuth 2.0 Actions

  • GET /oauth2/authorize - Authorization endpoint
  • POST /oauth2/token - Authorization-code exchange and rotating refresh-token grant
  • GET /oauth2/userinfo - Retrieve verified user claims
  • POST /oauth2/revoke - Revoke a legacy opaque token or complete refresh-token family

Tenant and Client Rules

  • One Client ID belongs to exactly one immutable tenant.
  • Public clients have no secret and must use S256 PKCE.
  • Redirect URIs use exact matching; HTTPS is required except for localhost development.
  • The server derives tenant identity from the Client record and token, never from a caller-selected database or network header.

Refresh Rules

  • Every successful refresh returns a replacement refresh_token.
  • The presented predecessor becomes unusable immediately.
  • Replaying an old token is rejected and may revoke the complete token family.
  • Active sessions use a rolling 60-day refresh expiry.
  • Signed access JWTs can remain valid at offline verifiers until their short expiry.