Platform / API access management
Decide which apps call which APIs.
Authorization servers, custom scopes and access policies, beside your identity data.
Authorization servers for your APIs
Describe each API as a resource with its own audience, scopes, claims and token lifetime, and preview a token before you ship.
- Custom scopes and custom claims
- Access policies by client, group, grant and scope
- Token preview in the console
The standard endpoints
Clients and gateways that understand OAuth 2.1 work without IdRa-specific code.
- Discovery, JWKS, userinfo, introspection and revocation
- Authorization code with PKCE (S256), client credentials, refresh and device code
- On-behalf-of token exchange, JWT bearer, pushed authorization requests, signed request objects and dynamic client registration
- Refresh and device-code grants re-run access policy, and a deny refuses the grant
- The OpenID conformance suite, run by us, with no failures
Machine access you can see
Service apps use client credentials, admin tokens act with their owner’s current role, and every grant is covered by rate limits.
- Admin API tokens with last-used tracking
- Signing-key rotation
- Rate-limit headers on the management API
Built on open standards.
- OAuth 2.1
- RFC 7662 introspection
- RFC 7009 revocation
- JWKS
Create your organization.
Pick an address and confirm your email, then sign in as its first admin. A setup wizard takes you through the rest.
