OAuth2 Authorization Endpoint.

Initiates the authorization code flow. If the user is authenticated and has granted consent (or client is first-party), redirects with an authorization code. Otherwise, returns information for consent UI.

curl -X GET "https://api.davi.social/oauth2/authorize" \
  -H "Authorization: Bearer <token>"

Handle consent form submission.

Called by frontend after user approves or denies consent.

curl -X POST "https://api.davi.social/oauth2/authorize/consent" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{ /* request body */ }'

OAuth2 Token Endpoint.

Supports:

• authorization_code: Exchange code for tokens
• refresh_token: Refresh access token

curl -X POST "https://api.davi.social/oauth2/token" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{ /* request body */ }'

Token Introspection Endpoint (RFC 7662).

Allows clients (typically resource servers) to validate tokens.

curl -X POST "https://api.davi.social/oauth2/introspect" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{ /* request body */ }'

Token Revocation Endpoint (RFC 7009).

Revokes an access or refresh token.

curl -X POST "https://api.davi.social/oauth2/revoke" \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{ /* request body */ }'

JSON Web Key Set endpoint.

Returns the public keys used to verify ID tokens and other JWTs.

curl -X GET "https://api.davi.social/oauth2/.well-known/jwks.json" \
  -H "Authorization: Bearer <token>"

OpenID Connect Discovery document.

Returns the OAuth2/OIDC server configuration.

Every URL here is built from the configured issuer, never from the path the request arrived on. The router is reachable at more than one prefix — the canonical /oauth2 mount plus two deprecated aliases — and OIDC requires the discovery issuer to equal the iss claim of an id_token exactly. A path-derived issuer makes that impossible: it says something different depending on which prefix a client happened to use, and at most one of those can match what the tokens actually carry.

curl -X GET "https://api.davi.social/oauth2/.well-known/openid-configuration" \
  -H "Authorization: Bearer <token>"

OIDC UserInfo endpoint.

Returns user information based on granted scopes.

Deliberately not registered on this router: UserInfo is an OIDC endpoint and belongs on the OAuth2 mount, next to the discovery document that advertises it. router_oauth2 registers this same function at /oauth2/userinfo. Defined here because it is auth-user identity, and to keep the OAuth2 router free of a second get_current_auth_context import cycle.

curl -X GET "https://api.davi.social/oauth2/userinfo" \
  -H "Authorization: Bearer <token>"

Get grouped scope metadata for consent screen.

Groups scopes by category and provides appropriate consent descriptions based on the level of access requested. Scopes with requires_ownership=True are flagged as requiring resource-level access (vs personal resources).

curl -X GET "https://api.davi.social/oauth2/scopes" \
  -H "Authorization: Bearer <token>"

Get OAuth app details for consent pages and login banners.

Unauthenticated endpoint. Returns app info with icon (fallback to org logo), organization details, and optionally scope groups.

curl -X GET "https://api.davi.social/oauth2/client-info" \
  -H "Authorization: Bearer <token>"