new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

Better Auth · Plugins · all subjects

oidc-provider/api-methods

3 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

registerOAuthApplication API Parameters

The POST /oauth2/register endpoint accepts the following parameters: redirect_uris (string[], required, default ["https://client.example.com/callback"]); token_endpoint_auth_method ("none" | "client_secret_basic" | "client_secret_post", optional, default "client_secret_basic"); grant_types (array of strings including "authorization_code", "implicit", "password", "client_credentials", "refresh_token", "urn:ietf:params:oauth:grant-type:jwt-bearer", "urn:ietf:params:oauth:grant-type:saml2-bearer", optional, default ["authorization_code"]); response_types (["code", "token"], optional, default ["code"]); client_name (string, optional, default "My App"); client_uri (string, optional, default "https://client.example.com"); logo_uri (string, optional, default "https://client.example.com/logo.png"); scope (string, optional, default "profile email"); contacts (string[], optional, default ["admin@example.com"]); tos_uri (string, optional, default "https://client.example.com/tos"); policy_uri (string, optional, default "https://client.example.com/policy"); jwks_uri (string, optional, default "https://client.example.com/jwks"); jwks (Record<string, any>, optional, default {"keys": [{"kty": "RSA", "alg": "RS256", "use": "sig", "n": "...", "e": "..."}]}); metadata (Record<string, any>, optional, default {"key": "value"}); software_id (string, optional, default "my-software"); software_version (string, optional, default "1.0.0"); software_statement (string, optional). By default, client registration requires authentication unless allowDynamicClientRegistration is set to true.

UserInfo Endpoint Details

The UserInfo endpoint is available at GET /oauth2/userinfo and requires a valid access token in the Authorization header. Server-side usage calls auth.api.oAuth2userInfo() with headers containing the Bearer token. Third-party OAuth clients call the endpoint via standard HTTP fetch to https://your-domain.com/api/auth/oauth2/userinfo with the Authorization header. Returned claims depend on granted scopes: openid scope returns the user's ID (sub claim), profile scope returns name, picture, given_name, family_name, and email scope returns email and email_verified.

Consent Endpoint Usage Methods

The POST /oauth2/consent endpoint accepts: accept (boolean, true to grant consent or false to deny), and consent_code (string, required when using URL parameter method but not needed for cookie-based flow). Method 1 extracts consent_code from URL search parameters and passes it in the request body. Method 2 relies on the consent code being automatically stored in a signed cookie, so only the accept decision needs to be submitted.

Give your agent this brain

oidc-provider/api-methods — Better Auth · Plugins