catalog / protocols

OAuth 2.1 Authorization Code + PKCE

Delegated authorisation done the way current guidance requires.

17 capabilities 7 sections reference specification

Build against it

# give your agent the catalog — no account, no install
claude mcp add provespec -- npx -y provespec-mcp

# then, from any agent session
spec_get(slug: "oauth2-authorization-code")                → the capability tree
spec_checklist(slug: "oauth2-authorization-code")          → the questions to answer
spec_grade(slug: "oauth2-authorization-code", grades: [...])  → parity % + the gap list

# or just fetch it
curl https://provespec.com/catalog/oauth2-authorization-code/spec.json

Grade every capability below as yes · partial · no · na, with a file reference as evidence. Whatever you leave ungraded counts as missing — the gap list is the work queue.

Or just paste this to your agent

Use the ProveSpec MCP server. Fetch the "oauth2-authorization-code" spec with
spec_get, then walk spec_checklist and grade this repository against it —
one verdict per capability, each with a file reference as the note.
Call spec_grade with the results and give me the gap list as the plan.

If the server is not registered, add it first:
  claude mcp add provespec -- npx -y provespec-mcp

The specification

Flow 4

✓ Client redirects to the authorization endpoint response_type=code
✓ User authenticates and consents at the provider never at the client
✓ Provider redirects back with a code short-lived, single use
✓ Client exchanges the code at the token endpoint server-to-server

PKCE 3

✓ code_verifier generated per request high entropy
✓ code_challenge sent with S256 plain is not acceptable
✓ Token exchange rejects a mismatched verifier

State 2

✓ state parameter bound to the user session CSRF defence
✓ Redirect URI matched exactly against registration no wildcards

Scopes 1

✓ Requested, granted and enforced scopes are distinct granted may be narrower

Tokens 3

✓ Access token short-lived minutes, not days
✓ Refresh token rotation with reuse detection reuse revokes the family
✓ Tokens never placed in URLs or logs

Endpoints 2

✓ Token revocation RFC 7009
✓ Discovery document /.well-known/openid-configuration

Security 2

✓ Implicit flow not offered removed in OAuth 2.1
✓ Clients that cannot keep a secret are treated as public

Download spec.json All 53 specs