Agora Authorization Server
Agora's OAuth 2.0 / OpenID Connect authorization server, served on its own domain at auth.agorareal.com and reached by redirect from the Cortex sign-in host (cortex.agorareal.com → auth.agorareal.com/?client_id=...). It publishes both RFC 8414 authorization-server metadata and OpenID Connect discovery anonymously: issuer https://auth.agorareal.com, authorization-code, refresh-token, device-code (urn:ietf:params:oauth:grant-type:device_code) and client-credentials grants, PKCE S256, RS256 ID tokens, and the scopes openid, profile, email and offline_access. The deployment is a WorkOS AuthKit hosted instance on Agora's own domain; no client registration is offered publicly, and the protected resources it fronts are not documented.