BUILD

OAuth tokens

Access tokens, refresh tokens, claims, expiry, and revocation behavior.

POST/oauth/token

Exchange a code or refresh token

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/oauth/token'
  -H 'Content-Type: application/x-www-form-urlencoded'
  --data-urlencode 'grant_type=authorization_code'
  --data-urlencode 'code=YOUR_AUTHORIZATION_CODE'
  --data-urlencode 'client_id=YOUR_CLIENT_ID'
  --data-urlencode 'redirect_uri=YOUR_REDIRECT_URI'
  --data-urlencode 'code_verifier=YOUR_CODE_VERIFIER'
  --data-urlencode 'resource=https://identity.lucionglobal.com/mcp'

Authentication

client authentication

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

GET/oauth/userinfo

Return scoped OIDC claims

This operation is part of the public Lucion Identity contract.

Safe request

curl -X GET 'https://identity.lucionglobal.com/oauth/userinfo'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'

Authentication

OAuth bearer

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

POST/oauth/revoke

Revoke an OAuth token and its refresh-token family

This operation is part of the public Lucion Identity contract.

Safe request

curl -X POST 'https://identity.lucionglobal.com/oauth/revoke'
  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
  -H 'Content-Type: application/json'
  -H 'Idempotency-Key: YOUR_IDEMPOTENCY_KEY'
  --data '{}'

Authentication

OAuth token

Request

No request body documented.

Responses and errors

Request IDs: X-Request-IDFull OpenAPI operation

Validation

Validate issuer and audience for OIDC ID tokens.
Check expiry and revoked state for access tokens.
Store refresh tokens server-side and treat them as secrets.
Refresh-token rotation and reuse protections are enforced by the runtime.