OAuth and OIDC endpoints

The token endpoint accepts a standard application/x-www-form-urlencoded body or JSON, with OAuth snake_case field names or their camelCase equivalents. Confidential clients can send their secret as client_secret or with HTTP Basic authentication.

`GET /api/oauth/app/:clientId`

Returns public app metadata: id, name, description, iconUrl, and websiteUrl. Errors:

404 app not found

The authorization endpoint. Redirect the user here with:

string

required

Your app’s client ID.

string

required

Must exactly match one of the app’s registered redirect URIs, or be a local development URL when development mode is on.

string

Space-separated scopes. Standard scopes must be in the app’s allowlist. user_id and one encryption mode (e2ee:symmetric or e2ee:asymmetric, optionally with e2ee:reset) can be added per request.

string

Returned unchanged on the callback. Required by the SDK helpers.

string

Copied into the id_token.

string

PKCE challenge. Required for public clients.

string

S256 or plain. Use S256.

string

none, login, consent, or select_account, space-separated.

On success, Ave redirects to redirect_uri?code=...&state=.... When an encryption scope was granted, the keys follow in the fragment:

Mode	Fragment parameters
`e2ee:symmetric`	`app_key`
`e2ee:asymmetric`	`app_public_key`, `app_private_key`
With `e2ee:reset`	The new keys, `app_key_old`, `app_public_key_old`, `app_private_key_old`, and `app_key_reset=true`

Values are standard base64. The sign-in page rejects an authorization request with:

invalid_scope — a standard scope outside the allowlist, or more than one encryption mode
unsupported_encryption_mode — a reserved encryption scope such as e2ee:pqc:kyber

`POST /api/oauth/token`

Supported grant_type values: authorization_code and refresh_token.

authorization_code
refresh_token

{
	"grant_type": "authorization_code",
	"code": "AUTHORIZATION_CODE",
	"redirect_uri": "https://yourapp.com/callback",
	"client_id": "YOUR_CLIENT_ID",
	"code_verifier": "PKCE_VERIFIER"
}

{
	"grant_type": "refresh_token",
	"refresh_token": "rt_...",
	"client_id": "YOUR_CLIENT_ID",
	"client_secret": "YOUR_CLIENT_SECRET"
}

Public clients omit client_secret.

Authorization code grant

Validates the code, its expiry, the redirect URI, and either the PKCE verifier (when the authorization used a code challenge) or the client secret. Returns tokens and a scope-filtered user payload: id is always present, display name, handle, and avatar require profile, and email requires email. Encryption keys are never part of this response; they are delivered only in the callback fragment.

string

Opaque bearer token accepted by Ave APIs.

string

Signed JWT for Ave API authorization. Its audience is Ave’s resource audience.

string

Returned when openid is granted. Its audience is your client ID.

string

Returned when offline_access is granted.

string

Returned when user_id is granted.

Refresh token grant

Validates the token record, client ownership, the active app authorization, and revocation, reuse, and expiry state, then rotates the refresh token and returns new access and refresh tokens with the granted scope. An id_token is included only with openid. Reuse detection is scoped to the rotated token lineage that was reused, not to unrelated refresh tokens held by the same app on other devices. Disconnecting an app removes its authorization codes, access tokens, refresh tokens, and wrapped encryption keys for that identity. Reconnecting does not restore old tokens and provisions new keys.

`GET /api/oauth/userinfo`

Authorization: Bearer <access_token_or_access_token_jwt> Returns claims based on granted scopes:

always sub and iss
profile: name, preferred_username, picture
email: email
user_id: user_id

Why userinfo may omit fields

Claims are scope-gated. Missing email or profile fields usually means those scopes were not granted.

Accepted token formats

The endpoint accepts both the opaque access_token and access_token_jwt when valid and unexpired.

Errors:

401 unauthorized missing bearer token
401 invalid_token invalid, expired, or unresolvable token

`GET /.well-known/openid-configuration`

Returns issuer metadata, endpoints, and supported scopes, response types, grant types (authorization_code, refresh_token), token endpoint authentication methods (client_secret_basic, client_secret_post, none), and ID token signing algorithms (RS256).

`GET /.well-known/jwks.json`

Returns the key set for JWT verification.

`GET /.well-known/webfinger?resource=...`

Returns the issuer discovery link for the requested resource.

Authorization management

These endpoints use the user’s Ave session and back the account dashboard and consent screen.

`GET /api/oauth/authorizations`

Lists the apps the user has authorized, per identity.

`GET /api/oauth/authorization/:clientId`

Returns the user’s most recent authorization for an app, including its wrapped encryption keys and public key. Ave’s sign-in page unwraps them locally.

`DELETE /api/oauth/authorizations/:authId`

Disconnects an app for one identity and records an activity log entry.

`PUT /api/oauth/authorization/:clientId/encryption-key`

Replaces the wrapped symmetric app key for an existing authorization with an envelope encrypted in the browser. Used by app key recovery.

​GET /api/oauth/app/:clientId

​GET https://aveid.net/signin

​POST /api/oauth/token

​Authorization code grant

​Refresh token grant

​GET /api/oauth/userinfo

​GET /.well-known/openid-configuration

​GET /.well-known/jwks.json

​GET /.well-known/webfinger?resource=...

​Authorization management

​GET /api/oauth/authorizations

​GET /api/oauth/authorization/:clientId

​DELETE /api/oauth/authorizations/:authId

​PUT /api/oauth/authorization/:clientId/encryption-key

`GET /api/oauth/app/:clientId`

`GET https://aveid.net/signin`

`POST /api/oauth/token`

Authorization code grant

Refresh token grant

`GET /api/oauth/userinfo`

`GET /.well-known/openid-configuration`

`GET /.well-known/jwks.json`

`GET /.well-known/webfinger?resource=...`

Authorization management

`GET /api/oauth/authorizations`

`GET /api/oauth/authorization/:clientId`

`DELETE /api/oauth/authorizations/:authId`

`PUT /api/oauth/authorization/:clientId/encryption-key`