MAmatrix
Session management

Get the OAuth 2.0 authorisation server metadata.

Gets the OAuth 2.0 authorisation server metadata, as defined in RFC 8414, including the endpoint URLs and the supported parameters that can be used by the clients.

This endpoint definition includes only the fields that are meaningful in the context of the Matrix specification. The full list of possible fields is available in the OAuth Authorisation Server Metadata registry, and normative definitions of them are available in their respective RFCs.

NOTE: The authorisation server metadata is relatively large and may change over time. Clients should:

  • Cache the metadata appropriately based on HTTP caching headers
  • Refetch the metadata if it is stale
get/_matrix/client/v1/auth_metadata

Request

Response

The OAuth 2.0 authorisation server metadata.

account_management_actions_supportedstring[]

List of actions that the account management URL supports.

This is an extension defined in this specification.

account_management_uristring uri

The URL where the user is able to access the account management capabilities of the homeserver.

This is an extension defined in this specification.

authorization_endpointstring uri required

URL of the authorisation endpoint, necessary to use the authorisation code grant.

code_challenge_methods_supportedstring[] required

List of OAuth 2.0 Proof Key for Code Exchange (PKCE) code challenge methods that the server supports at the authorisation endpoint.

This array MUST contain at least the S256 value, for improved security in the authorisation code grant.

device_authorization_endpointstring uri

URL of the device authorisation endpoint, as defined in RFC 8628, necessary to use the device authorisation grant.

grant_types_supportedstring[] required

List of OAuth 2.0 grant type strings that the server supports at the token endpoint.

This array MUST contain at least the authorization_code and refresh_token values, for clients to be able to use the authorisation code grant and refresh token grant, respectively.

[Added in v1.18] It MAY also contain urn:ietf:params:oauth:grant-type:device_code to indicate support for the device authorisation grant.

issuerstring uri required

The authorisation server's issuer identifier, which is a URL that uses the https scheme and has no query or fragment components.

This is not used in the context of the Matrix specification, but is required by RFC 8414.

prompt_values_supportedstring[]

List of OpenID Connect prompt values that the server supports at the authorisation endpoint.

Only the create value defined in Initiating User Registration via OpenID Connect is supported, for a client to signal to the server that the user desires to register a new account.

registration_endpointstring uri required

URL of the client registration endpoint, necessary to perform dynamic registration of a client.

response_modes_supportedstring[] required

List of OAuth 2.0 response mode strings that the server supports at the authorisation endpoint.

This array MUST contain at least the query and fragment values, for improved security in the authorisation code grant.

response_types_supportedstring[] required

List of OAuth 2.0 response type strings that the server supports at the authorisation endpoint.

This array MUST contain at least the code value, for clients to be able to use the authorisation code grant.

revocation_endpointstring uri required

URL of the revocation endpoint, necessary to log out a client by invalidating its access and refresh tokens.

token_endpointstring uri required

URL of the token endpoint, used by the grants.

Example response

{
  "account_management_actions_supported": [
    "org.matrix.profile",
    "org.matrix.devices_list",
    "org.matrix.device_view",
    "org.matrix.device_delete",
    "org.matrix.account_deactivate",
    "org.matrix.cross_signing_reset"
  ],
  "account_management_uri": "https://account.example.com/manage",
  "authorization_endpoint": "https://account.example.com/oauth2/auth",
  "code_challenge_methods_supported": [
    "S256"
  ],
  "device_authorization_endpoint": "https://account.example.com/oauth2/device",
  "grant_types_supported": [
    "authorization_code",
    "refresh_token",
    "urn:ietf:params:oauth:grant-type:device_code"
  ],
  "issuer": "https://account.example.com/",
  "registration_endpoint": "https://account.example.com/oauth2/clients/register",
  "response_modes_supported": [
    "query",
    "fragment"
  ],
  "response_types_supported": [
    "code"
  ],
  "revocation_endpoint": "https://account.example.com/oauth2/revoke",
  "token_endpoint": "https://account.example.com/oauth2/token"
}

Changes

No recorded changes to this operation across all 1 revision of this API.