OAuth metadata
AIGW exposes per-resource discovery at:
https://api.aigw.loginid.ai/<RESOURCE_ID>/.well-known/openid-configuration
and the equivalent OAuth metadata URL:
https://api.aigw.loginid.ai/<RESOURCE_ID>/.well-known/oauth-authorization-server
Important values
| Metadata | Value / purpose |
|---|---|
issuer | Global/core AIGW issuer |
authorization_endpoint | Per-resource /oauth2/auth URL |
token_endpoint | Global/core /oauth2/token |
jwks_uri | Global/core JWKS for agent-facing tokens |
registration_endpoint | AIGW DCR endpoint |
scopes_supported | Standard scopes plus Resource-specific scopes |
code_challenge_methods_supported | Use S256 |
token_endpoint_auth_methods_supported | client_secret_post/basic, private_key_jwt, none |
revocation_endpoint, userinfo_endpoint, end_session_endpoint, device_authorization_endpoint | Global/core endpoints |
grant_types_supported | Server capabilities; see the client-specific grant support below |
Authorization is Resource-specific. Token issuance and verification use the shared core issuer.
Do not use this JWKS for merchant-facing assertions
Merchant-facing AIGW JWT assertions use the per-resource issuer and per-resource ES256 JWKS. See JWTs and JWKS.
Discovery base is not the token issuer
The Console's Resource issuerUrl is the discovery base. The document's issuer remains the shared core issuer. Validate tokens against the returned value, including its trailing slash. A library that strictly derives the discovery URL from the issuer may need explicit metadata/endpoint configuration for this topology.
Use authorization_endpoint from Resource discovery for delegated Resource access, even if DCR returns the platform authorization endpoint. Use Authorization Code with PKCE for agent authorization and client_credentials for Proxy clients. See Token endpoint for the request formats.
Grant support by client type
Discovery describes authorization-server capabilities. A client can use only the grants enabled for its registration.
| Grant | AIGW integration | Guide |
|---|---|---|
authorization_code | Agent authorization with PKCE; OAuth client Resources for application sign-in | Authorization and code exchange |
refresh_token | Agent and application clients when a refresh token is issued | Refresh an agent access token |
client_credentials | Proxy clients obtaining service tokens; does not grant access on behalf of a user | Proxy client credentials |
implicit | Not enabled for clients created through AIGW registration or Resource setup | Use Authorization Code with PKCE |
urn:ietf:params:oauth:grant-type:device_code | Not enabled for clients created through AIGW registration or Resource setup | Use Authorization Code with PKCE |
An implicit or device-code entry in metadata, or a device_authorization_endpoint, does not enable those flows for your AIGW client. Dynamically registered confidential agents can also use client_credentials to authenticate as the agent itself; such a token does not represent user consent and cannot replace the user's token in credential redemption.