OAuth clients
Signing users in with their Gigadrive account, and why client registration is not self-service.
An OAuth client is a registration at Gigadrive IDP that lets an application sign people in with their Gigadrive account. It is the people-facing counterpart to an API key, which authenticates a machine.
Registration is granted per request
There is no self-service sign-up for an OAuth client and no dynamic client registration endpoint. Gigadrive IDP mounts discovery, the OAuth endpoints, and its sign-in callbacks, and nothing else. Ask for access before you build against it. See Requesting access.
Two issuers, two jobs
| Gigadrive IDP | Gigadrive Network API | |
|---|---|---|
| Host | idp.gigadrive.de | api.gigadrive.network |
| Authenticates | People | Machines, through API keys |
| Grants | Authorization code with PKCE, refresh token, device code | Client credentials |
| Endpoints | Authorize, token, userinfo, revoke, device authorization | Token |
Both publish /.well-known/openid-configuration and /.well-known/jwks.json, both cache those for 300 seconds, and both sign with RS256. Signing keys rotate, so select the key by the JWT's kid header rather than pinning one.
What a client registration holds
The client_id is a UUID and appears in every authorize request. Each redirect URI is registered up front, and redirect_uri must match one of them exactly. Localhost URIs are the one exception: a registered localhost redirect accepts a different port, so a desktop tool can bind whatever port is free.
Public clients, the ones that cannot keep a secret, must send PKCE, and S256 is the only code challenge method accepted. Confidential clients may omit PKCE and authenticate at the token endpoint instead, either with HTTP Basic or with client_id and client_secret in the body.
Lifetimes worth knowing
| Thing | Lives for |
|---|---|
| Authorization code | 10 minutes, single use |
| Access token | 5 minutes |
| Refresh token | 30 days, rotated on every use, only with offline_access |
| Device code | 10 minutes, polled every 5 seconds |
Consuming an authorization code is atomic, so a replayed code fails rather than issuing a second token. Only refresh tokens can be revoked at /oauth2/revoke, and only by the client they belong to. Access tokens are self-contained and expire on their own.
Grants are re-validated at redemption, not just at consent. A suspended account, a sign-in policy that no longer matches, or product access that has since been withdrawn will all refuse a code that was approved a minute earlier.
Where to go next
Endpoints documents every route and its parameters, and Scopes covers what a token can be granted. If you only need machine access to one application, an API key skips this entirely.