Authn API

This is the API for authn in MM

Security:

Paths	Authorization header
/oauth/token	Basic <base64(client_id:client_secret)> OR JWT client assertion (private_key_jwt)

JWT Client Authentication:

Clients can authenticate using signed JWT assertions instead of client secrets by providing:

client_assertion_type: urn:ietf:params:oauth:client-assertion-type:jwt-bearer
client_assertion: A signed JWT containing iss, sub, aud, jti, and exp claims

Base URLs

production

staging

Authentication

basicAuth http / basic

Contact

— authn@masmovil.com

Resources

Resource	Description
TokenInfo	API getting token claims once we have an accessToken
OAuth2	OAuth2 authentication endpoints
Magic Links	Retrieve access_token without credentials, only with a magic link
CIBA	OpenID Connect Client-Initiated Backchannel Authentication Flow
WebAuthn
Device Code

Property	Type	Description
`grant_type`*	string () authorization_codepasswordrefresh_tokenurn:ietf:params:oauth:grant-type:jwt-bearerurn:masstack:params:oauth:grant-type:magic-linkurn:masstack:params:oauth:grant-type:passwordlessurn:masstack:params:oauth:grant-type:webauthnurn:openid:params:grant-type:cibaurn:ietf:params:oauth:grant-type:device_code	Grant type of token
`scope`	string	Scope of permissions
`username`	string	Username of final customers (required for grant_type=password)
`password`	string	Password of final customers (required for grant_type=password)
`refresh_token`	string	Is a signed JWT whose main goal is to obtain a new access_token without repeating customer authentication once the user has an active session.
`state`	string	CSRF token used in the authorization request (for authorization_code and implicit flows)
`code`	string	Authorization code (required for authorization_code flow)
`code_verifier`	string	Code challenge value generated by the client in the authorization request (required for authorization_code flow)
`assertion`	string	Assertion with which to get an access_token (required for grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer)
`token`	string	Magic link token (required for grant_type=urn:masstack:params:oauth:grant-type:magic-link)
`otp`	string	One time password token (required for grant_type=urn:masstack:params:oauth:grant-type:passwordless)
`auth_req_id`	string	Authentication request ID (required for grant_type=urn:openid:params:grant-type:ciba)
`client_id`	string	The identifier of the client representing the app. (required for grant_type=urn:ietf:params:oauth:grant-type:device_code)
`device_code`	string	Device Code Authentication request ID (required for grant_type=urn:ietf:params:oauth:grant-type:device_code)
`subject_token`	string	Represents the identity of the party on behalf of whom the token is being requested while the actor_token represents the identity of the party to whom the access rights of the issued token are being delegated. (required for grant_type=urn:ietf:params:oauth:grant-type:token-exchange)
`subject_token_type`	string	Indicates the type of the security token in the subject_token parameter (required for grant_type=urn:ietf:params:oauth:grant-type:token-exchange)
`actor_token`	string	Represents the identity of the acting party. Typically, this will be the party that is authorized to use the requested security token and act on behalf of the subject. (used for grant_type=urn:ietf:params:oauth:grant-type:token-exchange)
`actor_token_type`	string	Indicates the type of the security token in the actor_token parameter. This is REQUIRED when the actor_token parameter is present in the request but MUST NOT be included otherwise. (used for grant_type=urn:ietf:params:oauth:grant-type:token-exchange)
`resource`	string	RFC 8707 — The URI of the resource server where the requested access token will be used. Supported for grant types: password, client_credentials, authorization_code, urn:openid:params:grant-type:ciba, urn:ietf:params:oauth:grant-type:device_code. When provided and the client has allowed_resources configured, the issued token's aud claim will be set to this value instead of the default application issuer. Must be an absolute URI without a fragment component. Not supported for refresh_token (resource from the original grant is preserved) or token-exchange.
`client_assertion_type`	string () urn:ietf:params:oauth:client-assertion-type:jwt-bearer	The format of the assertion as defined by the authorization server. The value must be urn:ietf:params:oauth:client-assertion-type:jwt-bearer when using JWT client authentication (private_key_jwt). This parameter is used together with client_assertion to authenticate the client using a signed JWT instead of client_secret.
`client_assertion`	string	A single JWT that contains the client authentication information. The JWT must be signed with the client's private key and contain the following claims: - iss: Client ID - sub: Client ID - aud: Token endpoint URL - jti: Unique identifier for the JWT - exp: Expiration time This parameter is used together with client_assertion_type for JWT client authentication (private_key_jwt) as an alternative to Basic authentication.

Property	Type	Description
`access_token`*	string	A token used by the client to make authenticated requests on behalf of the resource owner
`scope`	string	Scopes
`expires_in`	integer
`token_type`*	string
`refresh_token`	string	A token used by the client to obtain a new access token without having to involve the resource owner.

Property	Type	Description
`error`*	string () invalid_requestaccess_deniedinvalid_clientinvalid_grantunauthorized_clientunauthorized_grant_typeinvalid_scopeinvalid_targeterror_descriptionerror_uri	A single error code
`error_description`	string	A human-readable text providing additional information, used to assist in the understanding and resolution of the error occurred
`error_uri`	string

Property	Type	Description
`error`*	string () invalid_requestaccess_deniedinvalid_clientinvalid_grantunauthorized_clientunauthorized_grant_typeinvalid_scopeinvalid_targeterror_descriptionerror_uri	A single error code
`error_description`	string	A human-readable text providing additional information, used to assist in the understanding and resolution of the error occurred
`error_uri`	string

Property	Type	Description
`error`*	string () invalid_requestaccess_deniedinvalid_clientinvalid_grantunauthorized_clientunauthorized_grant_typeinvalid_scopeinvalid_targeterror_descriptionerror_uri	A single error code
`error_description`	string	A human-readable text providing additional information, used to assist in the understanding and resolution of the error occurred
`error_uri`	string

Property	Type	Description	Constraints	Default
`token`	string	A valid token (access_token or refresh_token) provided by authn
`scope`	string	If the value is all, it will delete all the user's sessions and refresh_tokens that it has.

Property	Type	Description	Constraints	Default
`token`*	string	The token that the client wants to revoke (access_token or refresh_token)
`token_type_hint`	string () access_tokenrefresh_token	A hint about the type of the token submitted for revocation. Possible values: - `access_token`: Indicates the token is an OAuth 2.0 access token - `refresh_token`: Indicates the token is an OAuth 2.0 refresh token This parameter is optional but helps optimize token lookup performance. If not provided, the server will automatically determine the token type.

Property	Type	Description	Constraints	Default
`token_endpoint`	string
`token_endpoint_auth_methods_supported`	string[]
`jwks_uri`	string
`response_modes_supported`	string[]
`subject_types_supported`	string[]
`id_token_signing_alg_values_supported`	string[]
`response_types_supported`	string[]
`scopes_supported`	string[]
`issuer`	string
`request_uri_parameter_supported`	boolean
`userinfo_endpoint`	string
`authorization_endpoint`	string
`http_logout_supported`	boolean
`frontchannel_logout_supported`	boolean
`end_session_endpoint`	string
`claims_supported`	string[]

Property	Type	Description
`login_hint`*	string	A hint to the OpenID Provider regarding the end-user for whom authentication is being requested. The value may contain an email address or msisdn, which identifies the end-user to the OP
`scope`	string	Scope of permissions
`binding_message`	string	A human-readable identifier or message intended to be displayed on both the consumption device and the authentication device to interlock them together for the transaction by way of a visual cue for the end-user. This interlocking message enables the end-user to ensure that the action taken on the authentication device is related to the request initiated by the consumption device.
`acr_values`	string	Requested Authentication Context Class Reference values. Space-separated string that specifies the acr values that the Authorization Server is being requested to use for processing this Authentication Request. Can include language preference using the format 'locale:xx' where xx is the ISO 639-1 language code (e.g., 'locale:eu', 'locale:es', 'locale:en'). Language preference is only supported by +Credentials provider.
`client_assertion_type`	string () urn:ietf:params:oauth:client-assertion-type:jwt-bearer	The format of the assertion used for client authentication (private_key_jwt). Must be `urn:ietf:params:oauth:client-assertion-type:jwt-bearer` when authenticating with a signed JWT instead of a client secret. Use together with `client_assertion`. Mutually exclusive with `Authorization: Basic` header.
`client_assertion`	string	A signed JWT used to authenticate the client (private_key_jwt). The JWT must be signed with the client's private key and contain: - `iss`: Client ID - `sub`: Client ID - `aud`: Backchannel authentication endpoint URL - `jti`: Unique identifier - `exp`: Expiration time Use together with `client_assertion_type`. Mutually exclusive with `Authorization: Basic` header.
`resource`	string	RFC 8707 — The URI of the resource server where the requested access token will be used. When provided and the client has allowed_resources configured, the issued token's aud claim will be set to this value instead of the default application issuer. Must be an absolute URI without a fragment component.

Property	Type	Description
`auth_req_id`*	string	REQUIRED. This is a unique identifier to identify the authentication request made by the Client.
`expires_in`*	integer	The duration in seconds for which the authentication request is valid.
`interval`*	integer	The minimum amount of time in seconds that the client SHOULD wait between polling to check if the authentication request has been completed.

Property	Type	Description	Constraints	Default
`username`	string
`user_verification`	string
`attestation`	string
`attachment`	string
`algorithms`	string[]
`discoverable_credential`	string

Property	Type	Description
`client_id`*	string	The identifier of the client representing the app.
`scope`	string	Scope of permissions
`resource`	string	RFC 8707 — The URI of the resource server where the requested access token will be used. When provided and the client has allowed_resources configured, the issued token's aud claim will be set to this value instead of the default application issuer. Must be an absolute URI without a fragment component.

Property	Type	Description
`device_code`*	string	REQUIRED. The unique code used for device verification.
`user_code`*	string	REQUIRED. The human-readable user code to be displayed to the user.
`verification_uri`*	string	REQUIRED. The end-user verification URI on the authorization server. The URI should be short and easy to remember as end users will be asked to manually type it into their user agent.
`verification_uri_complete`	string	A verification URI that includes the \"user_code\" (or other information with the same function as the \"user_code\"), which is designed for non-textual transmission.
`qr_code`*	string	REQUIRED. The base64 encoded QR code image data.
`expires_in`*	integer	REQUIRED. The lifetime in seconds of the "device_code" and "user_code"
`interval`	integer	The minimum amount of time in seconds that the client SHOULD wait between polling requests to the token endpoint. If no value is provided, clients MUST use 5 as the default.

Resources

Resources

Request body *

Responses

Snippet

Parameters

Request body

Responses

Response Headers

Snippet

Parameters

Responses

Response Headers

Snippet

Parameters

Responses

Response Headers

Snippet

Request body *

Responses

Response Headers

Snippet

Request body *

Responses

Snippet

Responses

Snippet

Responses

Snippet

Responses

Snippet

Request body

Responses

Response Headers

Snippet

Request body *

Responses

Snippet

Request body *

Responses

Snippet

Request body *

Responses

Snippet

Request body *

Responses

Snippet

Request body

Responses

Response Headers

Snippet