Authentication

AuthAction provides secure, standards-compliant authentication built on OAuth 2.0 and OpenID Connect. This section documents the authentication mechanisms available for your tenant.

Available Guides

• OAuth 2.0 & OIDC Endpoints: Complete reference for all tenant-specific endpoints including authorization, token, userinfo, JWKS, and logout.
• PKCE Authorization Flow: How AuthAction enforces the Authorization Code Flow with PKCE (S256) for secure public client authentication.
• Passkey Authentication: Enable passwordless login using device-bound passkeys with WebAuthn.
• OIDC Prompt: Control whether users see login or signup first using the prompt parameter.
• Mobile & Native App Redirect URIs: What redirect_uri to use for mobile/native apps, and the security tradeoffs between custom schemes and Universal Links.
• Token Exchange for AI Agents: Let a service act on a user’s behalf with a short-lived token that records both of them. Covers MCP servers and bringing your own identity provider.

Key Concepts

• PKCE is mandatory: AuthAction only supports the Authorization Code Flow with PKCE using the S256 challenge method. This eliminates the need for client secrets in public clients.
• OpenID Connect Discovery: Client SDKs can auto-configure by fetching your tenant’s /.well-known/openid-configuration document.
• RS256 signing: All tokens are signed with RS256 and can be verified via the JWKS endpoint.
• Delegation is recorded, not assumed: When a service acts for a user, the issued token keeps the user as sub and names the service in act, so an audit trail shows who authorised an action as well as what carried it out.