Skip to main content

Authorization

AIGW uses OAuth Authorization Code with PKCE for the agent/user authorization flow.

Authorization endpoint​

https://api.aigw.loginid.ai/<RESOURCE_ID>/oauth2/auth

Example​

?response_type=code
&client_id=<AGENT_CLIENT_ID>
&redirect_uri=https://agent.example.com/callback
&resource=https%3A%2F%2Fmcp.example.com%2Fmcp
&scope=openid%20ext_token%3Aread%20search%3Aread
&state=<STATE>
&nonce=<OIDC_NONCE>
&code_challenge=<S256_CHALLENGE>
&code_challenge_method=S256

The end user authenticates using a Resource-enabled identity provider and then sees the consent UI. On approval, AIGW redirects to the agent's registered callback with an authorization code.

Controls that can affect authorization​

  • Agent grant status for the requested Resource, shown within the Project (set by Agent policy or a person's decision);
  • requested scopes configured on the Resource;
  • enabled identity providers;
  • end-user authentication outcome;
  • end-user consent/denial.

Use S256 for PKCE, even if discovery also lists plain.

Request ext_token:read when merchant-token redemption follows this flow. Keep the PKCE verifier, state, and nonce bound to the same browser transaction. The Resource endpoint applies the effective agent policy and binds resource and token audience to the registered indicator before forwarding to the core OAuth server.