OAuth2 / OIDC Authorization Server

core-oauth-gateway

Authorization infrastructure for applications, BFFs, authentication providers, and resource servers.

CheckingService status

0.4.0Version

localEnvironment

OAuth 2.0 / OIDCProtocol

Quick links

API ReferenceComplete bilingual endpoint contracts, examples, schemas, and integration notes./docs/api-reference.htmlOIDC DiscoveryIssuer metadata and OpenID Connect capabilities./.well-known/openid-configurationOAuth MetadataAuthorization-server endpoints and supported protocol features./.well-known/oauth-authorization-serverJWKSPublic RSA keys used to validate gateway-signed JWTs./oauth2/jwks

Supported flows

Flow	Behavior
Authorization Code + PKCE	Browser and mobile authorization using exact redirect URI validation and S256 PKCE.
Client Credentials	Machine-to-machine access for authenticated confidential clients.
JWT Bearer	Signed assertion grant with replay protection and dynamic subject claims.
Refresh Token	Issues replacement access and refresh tokens from an active persisted refresh token.
Token Exchange	Exchanges a supported subject token for a gateway access token.

Operations

HealthSupabase connectivity and persistence readiness./healthService infoService name, version, and runtime environment./info

Security

Production guidance

Use TLS, private_key_jwt for confidential clients, S256 PKCE for public clients, and short token lifetimes. Never expose tokens, assertions, authorization codes, secrets, or private keys in URLs or logs.