⌘ K
OpenAPI

BUILD

OAuth 2.0

Lucion Identity implements an authorization-code OAuth server with PKCE, consent, scoped tokens, and revocation.

UserClient appLucion authorizationConsentAuthorization codeClient backendToken exchangeLucion API
Authorization Code + PKCE sequence
UserClient appLucion Identity
Client appAuthorization request + code_challengeLucion Identity
Lucion IdentityConsent + authorization codeClient app
Client backendcode + code_verifierToken endpoint
Token endpointaccess token / ID tokenLucion API
POST/oauth/authorize

Issue an authorization code

This operation is part of the public Lucion Identity contract.

Safe request
# Interactive consent endpoint: use the Lucion-hosted authorization screen in a browser.
# It requires the signed-in session cookie, exact Origin, and CSRF token; do not call it from a server-to-server script.

Authentication

session + PKCE

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation
GET/oauth/authorize/context

Validate an OAuth consent request before rendering

This operation is part of the public Lucion Identity contract.

Safe request
curl -G 'https://identity.lucionglobal.com/oauth/authorize/context' --data-urlencode 'client_id=YOUR_CLIENT_ID' --data-urlencode 'redirect_uri=YOUR_REGISTERED_REDIRECT_URI' --data-urlencode 'response_type=code' --data-urlencode 'scope=identity.api_keys.create offline_access' --data-urlencode 'state=YOUR_RANDOM_STATE' --data-urlencode 'code_challenge=YOUR_BASE64URL_SHA256_CHALLENGE' --data-urlencode 'code_challenge_method=S256' --data-urlencode 'resource=https://identity.lucionglobal.com/mcp'

Authentication

public + exact registered redirect + PKCE

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation
POST/oauth/token

Exchange a code or refresh token

This operation is part of the public Lucion Identity contract.

Safe request
curl -X POST 'https://identity.lucionglobal.com/oauth/token'
  -H 'Content-Type: application/x-www-form-urlencoded'
  --data-urlencode 'grant_type=authorization_code'
  --data-urlencode 'code=YOUR_AUTHORIZATION_CODE'
  --data-urlencode 'client_id=YOUR_CLIENT_ID'
  --data-urlencode 'redirect_uri=YOUR_REDIRECT_URI'
  --data-urlencode 'code_verifier=YOUR_CODE_VERIFIER'
  --data-urlencode 'resource=https://identity.lucionglobal.com/mcp'

Authentication

client authentication

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation
POST/oauth/revoke

Revoke an OAuth token and its refresh-token family

This operation is part of the public Lucion Identity contract.

Safe request
curl -X POST 'https://identity.lucionglobal.com/oauth/revoke'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

OAuth token

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation