OAuth 2.0 · Authorization Code + PKCE

Delegate narrow access without sharing passwords or API keys.

Implement OAuth 2.0 Authorization Code with mandatory PKCE S256, exact redirects, narrow scopes, rotating refresh tokens, and revocable user grants.

Authorization-server metadata Run the isolated OAuth simulation Developer Portal

Standard endpoints

Authorization: /api/oauth/authorize
Token: /api/oauth/token
Revocation: /api/oauth/revoke
Introspection: /api/oauth/introspect

Public clients authenticate with their client ID. Confidential server clients use HTTP Basic and keep their one-time secret outside browser code.

Security defaults

PKCE S256 is mandatory.
Redirect URIs match exactly; HTTPS is required except registered loopback callbacks.
Authorization codes expire after five minutes and are single-use.
Opaque access tokens expire after 15 minutes.
Refresh tokens rotate; reuse revokes the entire grant.

Authorization request

GET https://arcenciel.io/api/oauth/authorize
  ?response_type=code
  &client_id=aec_client_...
  &redirect_uri=https%3A%2F%2Fapp.example.com%2Fcallback
  &scope=models%3Aread%20offline_access
  &state=<unguessable-state>
  &code_challenge=<base64url-sha256-verifier>
  &code_challenge_method=S256

Verify both returned state and iss before exchanging the code with the original verifier.

Least-privilege scopes

OAuth reuses Developer API domains such as models:read, images:write, and webhooks:write. offline_access is separate.

Hard account boundary

Passwords, 2FA, sessions, trusted devices, connected accounts, API keys, account deletion, staff actions, and all Full routes remain interactive-session-only.