OAuth2 / OIDC Core
Authorization, token issuance/rotation, userinfo, revocation, and sign-out — the endpoints every login method converges on.
Start browser login (authorization code + PKCE)
Starts the authorization-code + PKCE (`S256`) login. Validates the client, the exact `redirect_uri` and PKCE, sets the `__Host-esp_flow_id` cookie, and sends the browser to the login: straight to `/oauth2/federation/start` when exactly one provider is enabled, to the OTP page in an OTP-only deployment, otherwise to `/oauth2/login`. On success the browser returns to `redirect_uri` with a single-use `code` and `state`.
OAuth token endpoint
Issues tokens by `grant_type`:
OIDC UserInfo endpoint
Returns the profile claims for the presented access token: `sub` always, `email` with the `email` or `profile` scope, `phone_number` with `phone`.
OIDC UserInfo endpoint (POST variant)
Same as `GET`. The access token may also be sent as the `access_token` field of a form body.
OAuth token revocation endpoint
Ends the login the refresh token belongs to: its whole refresh family, for that application only. An access token is accepted and ignored. Always `200`, even for an unknown token.
RP-Initiated Logout (OpenID Connect RP-Initiated Logout 1.0 §2)
Signs this browser out: deletes every refresh family under its session, the session and its cookie, then redirects to `post_logout_redirect_uri`. When the identity provider has its own sign-out, the browser goes there first and comes back through `/oauth2/logout/done`.
RP-Initiated Logout (form POST)
Ends nothing itself: a cross-site POST carries no `SameSite=Lax` session cookie, so it answers `303` and the browser repeats the request as the `GET` above, carrying only the parameters below (the first value of each).
Return point for the upstream provider's sign-out
Where the identity provider returns the browser after its own sign-out. Redirects to the `post_logout_redirect_uri` saved in the `__Host-esp_logout_to` cookie, or answers `200 Signed out.` when there is none. This is the one sign-out URL registered with the provider; applications never call it.