OAuth metadata
AIGW exposes per-resource discovery at:
https://api.aigw.eval.loginid.ai/<RESOURCE_ID>/.well-known/openid-configuration
and an OAuth authorization-server metadata path on the same ResourceResourceThe downstream system registered in a Project. Its kind (Token exchange or OAuth client) decides the role AIGW plays. base.
Important values
| Metadata | Observed behavior |
|---|---|
issuer | Global/core AIGW issuer |
authorization_endpoint | Per-resource /oauth2/auth URL |
token_endpoint | Global/core /oauth2/token |
jwks_uri | Global/core JWKS for agent-facing tokens |
registration_endpoint | AIGW DCR endpoint |
scopes_supported | Standard scopes plus Resource-specific scopes |
code_challenge_methods_supported | Includes S256 (and plain in observed metadata) |
token_endpoint_auth_methods_supported | client_secret_post/basic, private_key_jwt, none in observed metadata |
revocation_endpoint, userinfo_endpoint, end_session_endpoint, device_authorization_endpoint | Global/core endpoints |
grant_types_supported | authorization_code, implicit, client_credentials, refresh_token, device code |
This mixed per-resource/core topology is intentional in the supplied deployment: authorization is Resource-specific while token issuance/discovery issuer for agent-facing tokens is core.
Do not use this JWKS for merchant-facing assertions
Merchant-facing AIGW JWT assertions use the per-resource issuer and per-resource ES256 JWKSJWKSJSON Web Key Set: a published set of public keys used to verify JWT signatures.. See JWTs and JWKS.