VersolaVersola/docs
versola.kzGitHub
RUEN

RFC 6749

OAuth 2.0 Authorization Framework

Specification: RFC 6749

OAuth 2.0 is the industry-standard protocol for authorization. It enables applications to obtain limited access to user accounts on an HTTP service.

Grant Types

  • Authorization Code Grant (with mandatory PKCE per OAuth 2.1)
  • Client Credentials Grant
  • Refresh Token Grant
  • Device Authorization Grant (RFC 8628) — not yet implemented

Removed by design (intentionally not supported per OAuth 2.1):

  • Implicit Grant — removed in OAuth 2.1
  • Resource Owner Password Credentials Grant — removed in OAuth 2.1

PKCE (Proof Key for Code Exchange)

  • code_challenge required on every authorization request
  • code_verifier required on every token exchange
  • S256 challenge method supported
  • plain challenge method supported (not recommended, allowed by spec)

Refresh Tokens

  • Refresh token rotation — a new refresh token is issued on every use
  • Old refresh token invalidated immediately upon use
  • Full session revocation on refresh token reuse (replay detection)

Bearer Token Usage

  • Access tokens accepted via Authorization: Bearer header only
  • Token passing via URL query parameters is rejected
  • Short-lived access tokens (configurable TTL)

Client Authentication

  • client_secret_basic — Authorization: Basic header
  • client_secret_post — client credentials in request body
  • private_key_jwt — not yet implemented
  • client_secret_jwt — not yet implemented

Endpoints

  • POST /authorize — Authorization endpoint
  • POST /token — Token endpoint
  • POST /revoke — Token Revocation (RFC 7009)
  • POST /introspect — Token Introspection (RFC 7662)
  • GET /.well-known/oauth-authorization-server — Server Metadata (RFC 8414) — not yet implemented