Process Flows

Process Flows

This section documents the OAuth 2.1 process flows supported by TokenAuthority, including sequence diagrams and endpoint specifications.

Authorization Flows

These flows handle user authorization and token issuance:

• Authorization Code Grant - The initial OAuth flow where a user authorizes a client and receives an authorization code
• Authorization Code Redemption - Exchanging an authorization code for access and refresh tokens

Token Management

These flows handle ongoing token lifecycle:

• Token Refresh - Using a refresh token to obtain new access and refresh tokens
• Token Revocation - Invalidating access or refresh tokens

Discovery Endpoints

These endpoints allow clients to automatically discover server capabilities:

• Authorization Server Metadata - RFC 8414 well-known endpoint for discovering OAuth endpoints and capabilities
• Protected Resource Metadata - RFC 9728 well-known endpoint for discovering resource-to-authorization-server relationships

Client Registration

These flows handle client identity and registration:

• Dynamic Client Registration - RFC 7591 programmatic client registration without manual intervention
• Client Metadata Documents - Using URL-based client identifiers with automatically fetched metadata