OAuth

The authorization server an app installs through (RFC 6749 authorization code with PKCE S256, RFC 7009 revocation, RFC 8414 discovery), at the root of the API host. Answers are RFC 6749 JSON ({error, error_description}) and every one carries Cache-Control: no-store and Pragma: no-cache.

📄️Start an authorization (redirects to the consent screen)

Where an app sends an admin to install it. Answers `302` to the consent screen on the app host —

📄️Exchange a code, or refresh, for tokens

RFC 6749 §4.1.3 and §6, form-encoded (`application/x-www-form-urlencoded`, as the RFC says) or

📄️Revoke a token

RFC 7009, client-authenticated like the token endpoint. Only your app's own tokens are touched:

📄️Discover the authorization server

RFC 8414 metadata — everything an OAuth library needs to configure itself, built from the same