OAuth Server Metadata

ChainIT exposes its OAuth 2.0 + OpenID Connect (OIDC) server configuration at the standard discovery endpoint defined by RFC 8414 and OIDC Discovery 1.0. Clients and libraries that understand the OIDC discovery flow can bootstrap themselves automatically from a single URL — no hard-coded endpoints required.

Endpoint

GET https://staging-api.chainit.online/oauth/.well-known/openid-configuration

Public: no authentication required.
Stable: the response shape is part of the public contract; only additive changes are expected.
Cacheable: safe to cache for a short period (minutes). Always re-fetch if a response field is missing.

Response

{
"issuer": "https://staging-api.chainit.online",
"authorization_endpoint": "https://staging-api.chainit.online/oauth/authorize",
"token_endpoint": "https://staging-api.chainit.online/oauth/token",
"userinfo_endpoint": "https://staging-api.chainit.online/oauth/userinfo",
"revocation_endpoint": "https://staging-api.chainit.online/oauth/revoke",
"end_session_endpoint": "https://staging-api.chainit.online/oauth/logout",
"jwks_uri": "https://staging-api.chainit.online/oauth/{{orgId}}/.well-known/jwks.json",
"response_types_supported": ["code"],
"grant_types_supported": [
  "authorization_code",
  "refresh_token",
  "client_credentials"
],
"token_endpoint_auth_methods_supported": [
  "client_secret_post",
  "client_secret_basic"
],
"revocation_endpoint_auth_methods_supported": [
  "client_secret_post",
  "client_secret_basic",
  "none"
],
"scopes_supported": ["openid", "profile", "email", "offline_access"],
"code_challenge_methods_supported": ["S256", "plain"]
}

Field	Description
`issuer`	Canonical base URL that issues access and ID tokens. Verifiers should compare this to the `iss` claim of received tokens.
`authorization_endpoint`	Authorization Code endpoint (RFC 6749 §4.1.1).
`token_endpoint`	Token exchange + refresh endpoint (RFC 6749 §4.1.3 / §6).
`userinfo_endpoint`	OIDC UserInfo endpoint.
`revocation_endpoint`	Token revocation endpoint (RFC 7009). See Token revocation.
`end_session_endpoint`	RP-Initiated Logout endpoint (OIDC). See Logout.
`jwks_uri`	Org-scoped JWKS URL template. Replace `{{orgId}}` with your organization UUID before use. See Token validation.
`response_types_supported`	`code` only — ChainIT exclusively supports the Authorization Code flow.
`grant_types_supported`	Grants accepted by the token endpoint.
`token_endpoint_auth_methods_supported`	How confidential clients authenticate to `/oauth/token`.
`revocation_endpoint_auth_methods_supported`	Includes `none` because public clients may revoke their own tokens without a secret.
`scopes_supported`	Scopes accepted by the authorization server (your app may be configured to allow a subset of these).
`code_challenge_methods_supported`	PKCE methods. Use `S256` for public / native / SPA clients.

`jwks_uri` placeholder

The jwks_uri value contains the literal {{orgId}} placeholder. Substitute your organization UUID (visible in the Developer Portal under Application → Advanced → JWKS URL) before fetching the keys.

Why use discovery

No magic strings: every other OAuth endpoint URL is derived from this document. If ChainIT ever moves a path, your integration keeps working.
Library support: most OIDC client libraries (Python authlib, JavaScript openid-client, Go coreos/go-oidc, .NET IdentityModel.Client) consume .well-known/openid-configuration natively.
Future-proofing: features such as PKCE, RP-Initiated Logout, and Token Revocation are advertised here so you never miss new capability rollouts.

Bootstrapping examples

Node.js — `openid-client`

import { Issuer } from "openid-client";

const issuer = await Issuer.discover(
"https://staging-api.chainit.online/oauth/.well-known/openid-configuration",
);

const client = new issuer.Client({
client_id: "<<your_client_id>>",
client_secret: "<<your_client_secret>>",
redirect_uris: ["https://app.example.com/callback"],
response_types: ["code"],
});

const tokens = await client.callback(
"https://app.example.com/callback",
client.callbackParams(req),
{ state, code_verifier },
);

Python — `authlib`

from authlib.integrations.requests_client import OAuth2Session

DISCOVERY = "https://staging-api.chainit.online/oauth/.well-known/openid-configuration"
metadata = requests.get(DISCOVERY).json()

session = OAuth2Session(
  client_id="<<your_client_id>>",
  client_secret="<<your_client_secret>>",
  scope="openid profile",
  redirect_uri="https://app.example.com/callback",
)

token = session.fetch_token(
  metadata["token_endpoint"],
  code=request.args["code"],
  code_verifier=code_verifier,
)

`curl`

curl https://staging-api.chainit.online/oauth/.well-known/openid-configuration | jq

Next steps

Related references

Token validation — JWKS, introspection
Token revocation (RFC 7009)
RP-Initiated Logout (OIDC)

Endpoint​

Response​

Why use discovery​

Bootstrapping examples​

Node.js — openid-client​

Python — authlib​

curl​

Next steps​