17 docs tagged with "oauth2"

PAR, JAR, and rate limiting for LuxID Partners with elevated security requirements. PAR and JAR are informational only - not currently implemented by LuxID.

Ready-made Postman collections, OpenAPI spec, and CI smoke-test scripts for the full LuxID token flow.

Overview of extended LuxID technical capabilities: UserInfo, introspection, revocation, webhooks, delegated authorisation, and cross-border federation.

Overview of LuxID authentication protocols - OIDC, OAuth 2.0, and SAML 2.0 - with guidance on choosing the right approach for your integration.

A consolidated reference of every parameter LuxID accepts on the authorization endpoint, with its required/optional status, accepted values, and LuxID specifics.

The ten most frequent LuxID integration mistakes, with exact error responses, root causes, and fixes.

End-to-end guide: become a LuxID Partner, register an Application, obtain credentials, and complete a first test login using Authorization Code + PKCE.

Patterns for one LuxID application acting on behalf of a user at another service: delegated tokens, token exchange, and refresh token scoping.

Authentication, authorisation, federation, sessions vs tokens, open standards, and JWT structure explained for LuxID integrators.

Core identity concepts and the LuxID domain model you need before writing any integration code.

Protecting backend APIs with OAuth 2.0 bearer tokens, scopes, audiences, and machine-to-machine patterns at LuxID.

Reference catalogue of OAuth 2.0 and OIDC error codes at LuxID with the most common cause and fix for each.

Security checklist for LuxID integrations: HTTPS, PKCE, state/nonce, ID Token validation, token storage, open redirects, and anti-patterns to avoid.

How LuxID rate limits the authorize, token and UserInfo endpoints, and how to handle HTTP 429 with Retry-After and exponential backoff.

How to persist refresh tokens, silently renew sessions, and avoid re-prompting users for credentials and OTP on every app restart.

Revoke refresh tokens or access tokens programmatically using the RFC 7009 revocation endpoint, and understand the relationship with user-initiated revocation.

ID Token, Access Token, and Refresh Token explained in depth: lifetimes, signing, validation rules, and the full LuxID claim catalogue including extensions.