Home
Xeonr Auth is the in-house identity provider for authentication and authorization across Xeonr and affiliated projects. It implements OAuth 2.0 and OpenID Connect.
Guides
Choosing a Grant Type
Which OAuth flow to use for your app.
Access Token Anatomy
What's inside a JWT and how to validate it.
Authorization Code & Implicit
User login for web and mobile apps, with refresh tokens.
Device Code
User login for CLIs and headless devices.
Client Credentials
Backend-to-backend authentication with no user context.
Service Tokens
Trusted internal services with pre-issued service account tokens.
Rich Authorization Requests
Request access to specific resources using authorization_details.
API Reference
Applications
Applications
Authentication
Authentication
Authorisations
Authorisations
Current User
Current User
OAuth Clients
OAuth Clients
xeonr.auth.api.v1.ConsoleService
xeonr.auth.api.v1.TeamsService
xeonr.auth.api.v1.UsersService
PRIVATEAccounts
Accounts
PRIVATEApplications
Applications
PRIVATEAuthentication
Authentication
PRIVATEOAuth Provider
OAuth Provider
PRIVATEService Accounts
Service Accounts
PRIVATExeonr.auth.private.v1.AuditService
AuditService exposes the per-organisation audit trail, the event-type catalog, and Discord webhook management to organisation admins.
PRIVATExeonr.auth.private.v1.AutomationService
AutomationService is the surface an application automation key can call. Every method here carries allow_automation_keys and accepts NOTHING else: a portal session, an OAuth access token or a service account token is refused, and a key is refused on every method that does not carry the option. The caller acts as the key's bound user, for the clients of the key's application, and nothing more — the same authorization core the consent screen and the MCP tools use decides what is actually granted. Core only. Edge replicas serve a read-only snapshot and do not mount this service; point automation at the core hostname.
PRIVATExeonr.auth.private.v1.BrandingService
Manages an organisation's brand profiles (the list of branded sign-in flows that application clients can select). Organisation administrators only.
PRIVATExeonr.auth.private.v1.OrganisationService
PRIVATExeonr.auth.private.v1.PasswordService
PasswordService provides password-based authentication methods