OIDC provider

Gigadrive Network runs an OpenID Connect provider on api.gigadrive.network for machine-to-machine authentication. Use this reference to implement the token exchange without the SDK or to verify an access token in your own service.

None of the three takes a bearer token. The two discovery endpoints answer with Cache-Control: public, max-age=300, stale-while-revalidate=600.

Discovery

grant_types_supported is ["client_credentials"] and nothing else. There is no authorization endpoint, no userinfo endpoint, and no revocation endpoint, so response_types_supported is empty and only token_endpoint is published. Tokens are signed with RS256, and jwks_uri points at /.well-known/jwks.json on the same origin.

scopes_supported lists every scope the platform knows, which includes the un-namespaced legacy names such as applications:read. Those still work and map onto their canonical network: form, but write new integrations against the canonical names.

Signing a person in happens on a different provider, idp.gigadrive.de. This one issues tokens to API keys only, including the ones the platform mints for Functions.

Getting a token

import { GigadriveClient } from '@gigadrive/sdk';

// Reads GIGADRIVE_CLIENT_ID and GIGADRIVE_CLIENT_SECRET, posts them to
// /oauth2/token on the first call, and reuses the token until it is nearly expired.
const client = new GigadriveClient();

const { items } = await client.storage.objects.list('reports', { limit: 20 });

for (const object of items) {
  console.log(object.key, object.contentLength);
}

client_id is the API key's id, a UUID. client_secret is its gdnet_secret_ string. Send them as HTTP Basic credentials or as form fields; when both are present, Basic wins. grant_type must be exactly client_credentials.

The granted scope string always starts with openid, and any scope stored on the key that the platform no longer recognises is dropped from it. No refresh token is issued. The response carries Cache-Control: no-store, and because the request itself sends no bearer header it counts against the anonymous per-IP budget of 600 requests a minute described in Rate limits.

Failures use the RFC 6749 shape, { "error": ..., "error_description": ... }, which is the one place the API departs from its usual { "error": "message" } body. Errors covers the rest.

A grant_type other than client_credentials never reaches that handler. Body validation rejects it first, with 422 and a validation payload instead of the RFC 6749 shape.

Token claims

Verifying a token

Select the signing key by the kid in the token header rather than pinning one, because keys rotate. Any standard JOSE library does this for you:

import { createRemoteJWKSet, jwtVerify } from 'jose';

const jwks = createRemoteJWKSet(new URL('https://api.gigadrive.network/.well-known/jwks.json'));

const { payload } = await jwtVerify(token, jwks, {
  issuer: 'https://api.gigadrive.network',
  audience: 'oauth2',
});

const scopes = payload.scopes as string[];
const applicationId = payload.applicationId as string | undefined;

A valid signature proves Gigadrive Network issued the token. It does not prove the key behind it still exists: revoking a key also stops the tokens already minted from it, so a signature check alone is not an authorization decision.