OAuth discovery & authorization

Discovery endpoints#

Use the metadata returned by the configured HTTPS origin as authoritative. Compatible clients register their own client; end users do not paste a shared client secret.

Authorization flow#

The client discovers metadata, registers an allowed callback, creates an S256 PKCE challenge and opens authorization. The user signs in, reviews the agent, chooses sites and approves scopes. The client exchanges the returned authorization code with its verifier and the expected resource audience.

Scopes and sites#

Read is the default. weeveo:write must be requested by the client and explicitly approved using Also allow changes. The current user must have administrator access to every selected site for that consent. All-sites approval snapshots the displayed list and rechecks membership at token use.

Token security#

The implementation validates exact registered callbacks and resource audience, requires S256 PKCE, uses expiring access tokens and rotating refresh tokens with reuse detection, stores token secrets hashed, and supports revocation. HTTPS callbacks and HTTP loopback callbacks for local agents are supported subject to callback validation.

Disconnect#

Revoking a grant invalidates its access and refresh tokens across its approved sites. Removing current workspace membership also prevents continued authorized site access. Reconnect when you intentionally want to add newly created sites.

Troubleshooting#

If sign-in loops, compare the client's registered callback and resource with discovery metadata, confirm the public HTTPS app origin, and verify the deployed OAuth schema. Do not attempt to fix a callback mismatch by loosening exact callback validation.