Skip to content
flintDocs

OAuth discovery and signing keys

Fetch Flint's discovery document when configuring an OAuth client or finding Flint's public signing keys. Discovery and key requests require no credentials.

Discovery documents#

GET /.well-known/openid-configuration and GET /.well-known/oauth-authorization-server return the same JSON document. Use either path on the API host for your deployment:

cURL
curl https://api.withflintpay.com/.well-known/openid-configuration

The issuer is the API base URL. Check it against the issuer you configured.

The document publishes:

  • issuer and jwks_uri.
  • The registered authorization_endpoint, token_endpoint, device_authorization_endpoint, and revocation_endpoint.
  • grant_types_supported, response_types_supported, response_modes_supported, and the token and revocation endpoint authentication methods.
  • code_challenge_methods_supported, with S256 when partner authorization is available.
  • scopes_supported, listing the API scopes available to the CLI. Partner apps request permission IDs from their own permission manifest; those app-specific IDs are not enumerated here.
  • service_documentation, subject_types_supported: ["public"], and id_token_signing_alg_values_supported: ["ES256"].

Endpoint and grant advertisements reflect availability in that deployment. Read OAuth, Partner OAuth, and CLI OAuth for their request formats.

To configure trust in an external OIDC issuer for a workload, create a workload identity. Its issuer, audience, subject, and claim conditions define the external tokens it accepts. Flint's own discovery document describes Flint's endpoints and signing keys.

Flint's discovery service does not provide OpenID Connect end-user sign-in for your application. The document has no userinfo_endpoint and does not advertise the openid scope. Discovery does not turn OAuth access tokens into JWTs.

Public signing keys#

Fetch GET /.well-known/jwks.json, or use jwks_uri from discovery:

cURL
curl -i https://api.withflintpay.com/.well-known/jwks.json

The response is a JSON Web Key Set with a keys array. Each published key has kty: "EC", crv: "P-256", use: "sig", alg: "ES256", public coordinates x and y, and a kid equal to its RFC 7638 thumbprint. Private key material is never included. An empty keys array means no signing keys are currently published; verification cannot succeed until a matching key is available.

When verifying a Flint-signed JWT, use a JWT library, select the key by kid, require ES256, and validate the claims required by the protocol that issued the JWT. Multiple keys may be published during rotation. The presence of a key does not mean every Flint credential is a JWT.

Caching and browser access#

All three responses use Cache-Control: public, max-age=900 and Access-Control-Allow-Origin: *. JWKS also returns an ETag. Send that value in If-None-Match to revalidate a cached key set; an unchanged set returns 304 Not Modified.

These fixed, unversioned protocol paths are outside the /v1 OpenAPI specification. They return protocol JSON without the Flint data envelope. Requests are rate limited by IP. A 429 response includes Retry-After and Flint-Rate-Limited-Reason.

Was this helpful?