feat: token exchange endpoint and documentation - #258
Merged
Merged
Conversation
Signed-off-by: Pavel Shukhman <pavel@reliza.io>
oej
requested changes
Aug 26, 2026
oej
left a comment
oej
left a comment
Collaborator
There was a problem hiding this comment.
Good work, just some smaller questions
Collaborator
|
If a client connects to a server that has no "/token" endpoint and no auth - will it receive a 404 which feels weird. i would like that every TEA service has /token endpoint and if no auth is in play, simply return "200 ok" |
…n endpoint Follow-up to @oej's review of CycloneDX#258. - The token endpoint section referred to the OpenAPI file by a relative repository link, which will not survive extraction into the ECMA document. It now refers to the TEA OpenAPI specification by name. - The `invalid_token` retry rule did not say where the error code lives. It is the `error` attribute of the `WWW-Authenticate: Bearer` challenge header on the 401 response (RFC 6750 section 3), not part of the token, which stays opaque. The sentence names the header and shows it. - The Discovery section is replaced by a Client flow section giving the complete sequence: try the resource without credentials; 200 means open; 401 with a Bearer challenge means obtain a token from /token and repeat with the bearer token; on invalid_token, refresh and retry once. A client holding an API key may go to the token endpoint directly. Clients shall not probe /token to discover authentication, and shall not send the API key to resource endpoints. - New Servers without authentication section: such a server need not implement /token (a token response must carry a token and the mandatory grant requires client authentication, so it could only issue a meaningless one), shall not answer 401, and shall ignore rather than reject a bearer token presented anyway. - New Mixed servers section: a server with any protected endpoint is a server that requires authentication and implements the baseline in full; open endpoints behave as on an open server; protected endpoints challenge per endpoint; authorization of protected data stays the server's decision. - Protected resource metadata (RFC 9728) kept as an optional subsection, stated not to replace the challenge as the discovery mechanism. - Scope section points at the two new sections. - Spec: the /token description says a server that requires authentication on any endpoint implements it, an open server need not, and clients do not probe it; a 404 means only "not implemented". Validated with openapi-generator v7.12.0 (pre-existing unused-model warning only). All intra-document anchors resolve. Signed-off-by: Claude Code (ReARM Agent) <rearm-agent-claude@reliza.io>
Token endpoint: client flow, open and mixed servers, review follow-ups Signed-off-by: Pavel Shukhman <taleodor@users.noreply.github.com>
Contributor
Author
@oej Clarified this in follow up commit. Essentially, client never starts with accessing token endpoint, it only does so if receives 401 prior. So client shouldn't be probing /token. |
Open
This was referenced Sep 13, 2026
oej
pushed a commit
that referenced
this pull request
Sep 14, 2026
Mark token exchange as outside the interoperable profile and remove the incomplete subject_token fields. Keeps the client_credentials baseline from #258, and narrows its token-exchange mention to an optional future extension pending a concrete consumer. Closes #273. Signed-off-by: Mehrn0ush <mehrnoush.vaseghi@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements /token endpoint and corresponding documentation. The endpoint is not required for an open (no-auth TEA server), but if auth is present, the /token endpoint is required. If /token endpoint is used, at least HTTP Basic authentication must be supported, while there are other options.