API Endpoints

All endpoints use the base URL configured in AUTENTICO_APP_URL. The OAuth2 path prefix (/oauth2 by default) is configurable via AUTENTICO_APP_OAUTH_PATH.

Tip

An interactive Swagger UI is available at https://auth.example.com/admin/docs/ when Autentico is running.

Protocol endpoints (public)

Method	Path	Description
GET	/.well-known/openid-configuration	OIDC discovery document
GET	/oauth2/.well-known/openid-configuration	OIDC discovery document (alias)
GET	/.well-known/jwks.json	JSON Web Key Set
GET	/oauth2/authorize	Authorization endpoint — starts auth flow
POST	/oauth2/login	Login form submission
POST	/oauth2/signup	Self-signup form submission
GET/POST	/oauth2/mfa	MFA challenge page
GET	/oauth2/passkey/login/begin	Begin WebAuthn authentication
POST	/oauth2/passkey/login/finish	Finish WebAuthn authentication
POST	/oauth2/passkey/register/finish	Finish WebAuthn registration (passkey-only mode)
POST	/oauth2/token	Token endpoint (authorization_code, refresh_token, password)
POST	/oauth2/protocol/openid-connect/token	Token endpoint (Keycloak alias)
GET	/oauth2/userinfo	UserInfo endpoint
GET	/oauth2/protocol/openid-connect/userinfo	UserInfo endpoint (Keycloak alias)
POST	/oauth2/revoke	Token revocation (RFC 7009)
POST	/oauth2/introspect	Token introspection (RFC 7662)
GET	/oauth2/logout	Logout — deactivates SSO session

Self-service endpoint (public)

Method	Path	Description
POST	/user	Create a user account (self-signup, if enabled)

Client registration (admin-authenticated)

Method	Path	Description
POST	/oauth2/register	Register a new client
GET	/oauth2/register/{client_id}	Get client info
PUT	/oauth2/register/{client_id}	Update client
DELETE	/oauth2/register/{client_id}	Delete client

Admin API (admin-authenticated)

Method	Path	Description
GET	/admin/api/users	List all users
POST	/admin/api/users	Create a user
GET	/admin/api/users/{id}	Get user by ID
PUT	/admin/api/users/{id}	Update a user
DELETE	/admin/api/users/{id}	Delete a user
POST	/admin/api/users/unlock	Unlock a locked account
GET	/admin/api/clients	List all clients
POST	/admin/api/clients	Create a client
GET	/admin/api/clients/{id}	Get client by ID
PUT	/admin/api/clients/{id}	Update a client
DELETE	/admin/api/clients/{id}	Delete a client
GET	/admin/api/sessions	List sessions
DELETE	/admin/api/sessions/{id}	Revoke a session
GET	/admin/api/stats	Dashboard statistics
GET	/admin/api/settings	Get all settings
PUT	/admin/api/settings	Update settings
GET	/admin/api/onboarding	Check onboarding status (public)
POST	/admin/api/onboarding	Complete onboarding (public, one-time)

Authentication

Admin-authenticated endpoints require:

Authorization: Bearer <AUTENTICO_ADMIN_TOKEN>

CSRF protection is applied to browser-facing form endpoints (/oauth2/authorize, /oauth2/login, /oauth2/mfa, /oauth2/signup, /oauth2/onboard). Passkey endpoints are exempt — the WebAuthn challenge is the anti-CSRF mechanism.