FrontMCP Authentication overview API

openapi: 3.1.0
info:
  title: FrontMCP Authentication overview API
  version: '2026-11-08'
  description: 'GENERATED FROM DOCUMENTATION by API Evangelist on 2026-11-08: 11 operation(s) read from 3 public documentation page(s) (each operation
    names its page in x-source). This is not the provider''s published contract; FrontMCP has published no machine-readable contract that the
    pipeline could find. Engine: local.'
  x-evidence-tiers:
    code-example: 7
    documentation: 16
    pages-with-code: 6
    pages-read: 19
  x-generated-from: documentation
  x-provenance: generated
  x-authored-by: API Evangelist
  x-generated: '2026-11-08'
  x-generator: generate-contract-from-docs.py
  x-engine: local
  x-sources:
  - https://frontmcp.dev/reference/auth/cimd
  - https://frontmcp.dev/reference/auth/local
  - https://frontmcp.dev/reference/auth/remote
  x-docs-section: auth
servers:
- url: https://acme.eu.auth0.com
paths:
  /.well-known/jwks.json:
    get:
      operationId: get_well_known_jwks_json
      tags:
      - API
      summary: An RSA public key (JWKS) used for token verification.
      x-source: https://frontmcp.dev/reference/auth/local
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWellKnownJwksJsonResponse'
      x-evidence:
        kind: documentation
  /.well-known/oauth-authorization-server:
    get:
      operationId: get_well_known_oauth_authorization_server
      tags:
      - API
      summary: The authorization‑server metadata (RFC 8414).
      x-source: https://frontmcp.dev/reference/auth/local
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWellKnownOauthAuthorizationServerResponse'
      x-evidence:
        kind: documentation
  /.well-known/oauth-protected-resource:
    get:
      operationId: get_well_known_oauth_protected_resource
      tags:
      - API
      summary: The protected‑resource metadata (RFC 9728) that 401 answers point to.
      x-source: https://frontmcp.dev/reference/auth/local
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetWellKnownOauthProtectedResourceResponse'
      x-evidence:
        kind: documentation
  /api/groups:
    get:
      operationId: get_api_groups
      tags:
      - Api
      summary: GET /api/groups
      x-source: https://frontmcp.dev/reference/auth/remote
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: code-example
        language: javascript
        snippet: "fetch ( \"https://auth.example.com/api/groups\" , { \n headers: { authorization: `Bearer ${token}` }, \n })"
  /oauth/authorize:
    get:
      operationId: get_oauth_authorize
      tags:
      - Oauth
      summary: Checks the request and answers with the sign‑in page (HTML) and a cookie.
      x-source: https://frontmcp.dev/reference/auth/local
      parameters:
      - name: response_type
        in: query
        required: true
        schema:
          type: string
        description: Must be code.
      - name: client_id
        in: query
        required: true
        schema:
          type: string
        description: A registered client.
      - name: redirect_uri
        in: query
        required: true
        schema:
          type: string
        description: http or https URL.
      - name: code_challenge
        in: query
        required: true
        schema:
          type: string
        description: 43‑128 base64url characters.
      - name: code_challenge_method
        in: query
        required: false
        schema:
          type: string
        description: Only S256 is supported.
      - name: scope
        in: query
        required: false
        schema:
          type: string
        description: Space‑separated list of allowed scopes.
      - name: state
        in: query
        required: false
        schema:
          type: string
        description: Returned unchanged.
      - name: resource
        in: query
        required: false
        schema:
          type: string
        description: Must be this server's URL.
      - name: apps
        in: query
        required: false
        schema:
          type: string
        description: With incrementalAuth, the apps to grant.
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /oauth/callback:
    get:
      operationId: get_oauth_callback
      tags:
      - Oauth
      summary: Handles the sign‑in form submission (GET works for custom pages).
      x-source: https://frontmcp.dev/reference/auth/local
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /oauth/connect:
    get:
      operationId: get_oauth_connect
      tags:
      - Oauth
      summary: Connects a credential in the middle of a session (progressive auth).
      x-source: https://frontmcp.dev/reference/auth/local
      responses:
        '200':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /oauth/register:
    post:
      operationId: post_oauth_register
      tags:
      - Oauth
      summary: Registered ( POST /oauth/register )
      x-source: https://frontmcp.dev/reference/auth/cimd
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /oauth/token:
    post:
      operationId: post_oauth_token
      tags:
      - Oauth
      summary: Trades a code for tokens, refreshes them, or issues an anonymous token.
      x-source: https://frontmcp.dev/reference/auth/local
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/PostOauthTokenRequest'
      responses:
        '201':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/PostOauthTokenResponse'
      x-evidence:
        kind: documentation
  /oauth/ui/extra:
    post:
      operationId: post_oauth_ui_extra
      tags:
      - Oauth
      summary: Side requests from a custom React page.
      x-source: https://frontmcp.dev/reference/auth/local
      responses:
        '201':
          description: Success (status as documented)
      x-evidence:
        kind: documentation
  /oauth/userinfo:
    get:
      operationId: get_oauth_userinfo
      tags:
      - Oauth
      summary: Returns { sub, email, name } for the bearer token.
      x-source: https://frontmcp.dev/reference/auth/local
      responses:
        '200':
          description: Success (status as documented)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetOauthUserinfoResponse'
      x-evidence:
        kind: documentation
components:
  schemas:
    GetWellKnownJwksJsonResponse:
      type: object
      properties:
        keys:
          type: array
          description: Array of JWK objects.
    GetWellKnownOauthAuthorizationServerResponse:
      type: object
      properties:
        issuer:
          type: string
        authorization_endpoint:
          type: string
        token_endpoint:
          type: string
        userinfo_endpoint:
          type: string
        jwks_uri:
          type: string
        registration_endpoint:
          type: string
        token_endpoint_auth_methods_supported:
          type: array
        response_types_supported:
          type: array
        grant_types_supported:
          type: array
        scopes_supported:
          type: array
        code_challenge_methods_supported:
          type: array
        authorization_response_iss_parameter_supported:
          type: boolean
        client_id_metadata_document_supported:
          type: boolean
    GetWellKnownOauthProtectedResourceResponse:
      type: object
      properties:
        resource:
          type: string
        authorization_servers:
          type: array
        scopes_supported:
          type: array
        bearer_methods_supported:
          type: array
    PostOauthTokenRequest:
      type: object
      properties:
        grant_type:
          type: string
          description: authorization_code, refresh_token, or anonymous.
        code:
          type: string
          description: Authorization code (for authorization_code).
        code_verifier:
          type: string
          description: PKCE verifier.
        refresh_token:
          type: string
          description: Refresh token (for refresh_token).
        client_id:
          type: string
          description: Client identifier.
        client_secret:
          type: string
          description: If client authentication is required.
      required:
      - grant_type
    PostOauthTokenResponse:
      type: object
      properties:
        access_token:
          type: string
        refresh_token:
          type: string
        token_type:
          type: string
        expires_in:
          type: integer
        scope:
          type: string
    GetOauthUserinfoResponse:
      type: object
      properties:
        sub:
          type: string
        email:
          type: string
        name:
          type: string
tags:
- name: API
- name: Api
- name: Oauth