AuthAction OAuth 2.0 & OpenID Connect (OIDC) Endpoints

AuthAction provides tenant-specific OAuth 2.0 and OpenID Connect (OIDC) endpoints using the base format:

https://{tenant-name}.{region}.authaction.com/

Client SDKs can automatically discover and integrate these endpoints using the OpenID Connect Discovery document located at:

https://{tenant-name}.{region}.authaction.com/.well-known/openid-configuration

There’s no need to manually implement each endpoint individually when using a compatible OIDC client library.

---

1. Issuer URL

• Endpoint:

  https://{tenant-name}.{region}.authaction.com/

• Description:
  • Identifies the OIDC provider.
  • Used in discovery and validation.

---

2. OIDC Discovery Document

• Endpoint:

  https://{tenant-name}.{region}.authaction.com/.well-known/openid-configuration

• Method: GET
• Description:
  • Returns a JSON document describing all supported OIDC endpoints, scopes, claims, and other metadata.
  • Used by client SDKs to automatically configure integrations.

---

3. Authorization Endpoint

• Endpoint:

  https://{tenant-name}.{region}.authaction.com/oauth2/authorize

• Method: GET

• Description:

  • Starts the Authorization Code flow with PKCE.

• Query Parameters:

  Name	Required	Description
  response_type	Yes	Use code
  client_id	Yes	The application’s client ID
  redirect_uri	Yes	URL to redirect to after authorization
  scope	Yes	Space-separated list (e.g. openid email profile)
  state	No	Opaque value to prevent CSRF
  audience	No	Identifier of the target API
  code_challenge	Yes	A Base64-URL-encoded SHA256 hash of the code_verifier
  code_challenge_method	Yes	Method used for the challenge. Only S256 is supported
  nonce	No	A string value to associate a client session with an ID Token

---

4. Token Endpoint

• Endpoint:

  https://{tenant-name}.{region}.authaction.com/oauth2/token

• Method: POST

• Content-Type: application/x-www-form-urlencoded

• Description:

  • Exchanges code for tokens. PKCE is required for authorization_code flow.

• Form Parameters:

  Name	Required	Description
  grant_type	Yes	authorization_code or client_credentials
  client_id	Yes	App’s client ID
  client_secret	Required only for M2M flow	App’s secret (required for client_credentials)
  code	If using authorization_code	Authorization code from /authorize
  redirect_uri	If using authorization_code	Must match the one used in auth step
  code_verifier	If using authorization_code	Raw PKCE verifier string used to match the code_challenge
  audience	Optional	API identifier

---

5. User Info Endpoint

• Endpoint:

  https://{tenant-name}.{region}.authaction.com/oauth2/user

• Method: GET
• Headers:
  • Authorization: Bearer {access_token}
• Description:
  • Returns user profile info.

---

6. JWKS URI

• Endpoint:

  https://{tenant-name}.{region}.authaction.com/.well-known/jwks.json

• Description:
  • Used to validate JWT signatures.
  • Automatically used by libraries supporting OIDC.

---

7. End Session (Logout) Endpoint

• Endpoint:

  https://{tenant-name}.{region}.authaction.com/oauth2/logout

• Method: GET
• Query Parameters:

  Name	Required	Description
  post_logout_redirect_uri	Yes	URL to redirect to after logout
  id_token_hint	Yes	Previously issued ID Token to help identify the session

---

8. Token Revocation Endpoint

• Endpoint:

  https://{tenant-name}.{region}.authaction.com/oauth2/revoke

• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Form Parameters:

  Name	Required	Description
  token	Yes	Access or refresh token
  client_id	Yes	Application client ID
  client_secret	Yes	Application client secret

---

9. Supported Claims

Included in ID and access tokens:

• aud - Intended audience
• created_at - User creation time
• email - User’s email address
• email_verified - Email verification status
• exp - Expiration timestamp
• iat - Issued at timestamp
• iss - Issuer URL
• name - Full name
• sub - Subject (user ID)

---

Conclusion

To use AuthAction, applications must construct the correct URLs using their tenant name and region, and use the endpoints according to OAuth2/OIDC protocol flows. PKCE is mandatory for all Authorization Code flows. Make sure to handle tokens securely and validate them using the JWKS endpoint.