Skip to content
Kindgi

Overview

Auth

Section titled “Auth”

OAuth 2.0 / OIDC identity providers + session lifecycle. Layers browser-based auth on top of the static bearer-token surface: bearer tokens continue to work byte-shape-identical; session tokens use the kgi_sk_* prefix so the same middleware routes both flavors. Providers are caller-plugged via IdentityProviderBinding (no baked-in list). Sessions persist via SessionStoreBinding. Code exchange is caller-supplied via exchangeCode. PKCE (S256) is mandatory. clientSecretRef is a REFERENCE — the plaintext secret never crosses the wire.

Operations

Section titled “Operations”
GET
/v1/auth/providers
POST
/v1/auth/providers
POST
/v1/auth/providers/{providerId}/unregister
POST
/v1/auth/login/{providerId}
POST
/v1/auth/callback/{providerId}
POST
/v1/auth/refresh
POST
/v1/auth/logout