FIG. 06 · Documentation

The field guide.

Reference docs for the OAuth service for AI agents and a standards-native identity platform. Catalogued by protocol, written to be integrated — not skimmed.

$ npx oauth-work init --tenant acme
agent→ authorize→ token→ MCP tool OAuth 2.1 · DPoP · scoped consent
FIG. 06 · Catalogue

Every protocol, one click away.

FIG. 00 · Start Quickstart

From zero to a working tenant and first token in five minutes.

 → FIG. 01 · MCP MCP authorization

OAuth for Model Context Protocol servers and clients — scoped tokens, consent, discovery.

 → FIG. 02 · A2A A2A delegation

Agent-to-agent and on-behalf-of authorization between agents, scoped per agent.

 → FIG. 03 · OIDC OIDC + OAuth 2.1

Discovery, JWKS, authorization-code + PKCE, single-use codes.

 → FIG. 04 · SAML SAML 2.0

SP/IdP setup, XML-DSig verification, assertion mapping.

 → FIG. 05 · SCIM SCIM 2.0

User and group provisioning, attribute mapping, sync.

 → FIG. 06 · DPoP DPoP · RFC 9449

Sender-constrained tokens, proof construction, key binding.

 → FIG. 07 · WebAuthn WebAuthn

Passkey registration, packed attestation verification.

 → FIG. 08 · VC Verifiable Credentials

VC-JWT, SD-JWT, Bitstring Status List revocation.

 → FIG. 09 · Tenancy Multi-tenancy & Management API

Per-tenant keys, did:web, the /v1 API, RBAC, webhooks, audit.

 → FIG. 10 · API API reference

Every endpoint, rendered live from the OpenAPI 3.1 document.

 →

Authorize a user in three calls.

1 Provision
# create a tenant
$ npx oauth-work init \
    --tenant acme
2 Authorize
GET /authorize
  ?response_type=code
  &client_id=acme-web
  &code_challenge=<S256>
  &scope=openid
3 Exchange
POST /token
  grant_type=
    authorization_code
  code_verifier=<…>

Read the spec. Then ship.

Start free and follow the quickstart, or browse the catalogue first.

Start free Open the quickstart