Aiflow Authentication

generated: '2026-09-14'
method: probed
source: https://auth.aiflow.solutions/.well-known/openid-configuration
docs: https://www.veratainsight.com/security
note: >-
  aiFlow publishes no developer API and no API authentication documentation. This profile is read
  verbatim from the OpenID Connect discovery document the company serves on its own Auth0 custom
  domain, auth.aiflow.solutions, which is the identity provider for the Verata web application
  (app.veratainsight.com redirects there to authenticate). It describes END-USER SIGN-IN to the
  product, not programmatic API access. No API key scheme, bearer-token scheme or developer
  credential issuance is documented anywhere on either brand's site.
scope_of_profile: application-sign-in
api_authentication_documented: false
issuer: https://auth.aiflow.solutions/
provider_stack: Auth0 (custom domain on the company's own registrable domain)
schemes:
- name: openIdConnect
  type: openIdConnect
  openIdConnectUrl: https://auth.aiflow.solutions/.well-known/openid-configuration
  in: header
  evidence: https://auth.aiflow.solutions/.well-known/openid-configuration
- name: oauth2
  type: oauth2
  flows:
    authorizationCode:
      authorizationUrl: https://auth.aiflow.solutions/authorize
      tokenUrl: https://auth.aiflow.solutions/oauth/token
      refreshUrl: https://auth.aiflow.solutions/oauth/token
    clientCredentials:
      tokenUrl: https://auth.aiflow.solutions/oauth/token
    deviceCode:
      deviceAuthorizationUrl: https://auth.aiflow.solutions/oauth/device/code
      tokenUrl: https://auth.aiflow.solutions/oauth/token
  evidence: https://auth.aiflow.solutions/.well-known/oauth-authorization-server
endpoints:
  authorization: https://auth.aiflow.solutions/authorize
  token: https://auth.aiflow.solutions/oauth/token
  userinfo: https://auth.aiflow.solutions/userinfo
  jwks: https://auth.aiflow.solutions/.well-known/jwks.json
  revocation: https://auth.aiflow.solutions/oauth/revoke
  registration: https://auth.aiflow.solutions/oidc/register
  device_authorization: https://auth.aiflow.solutions/oauth/device/code
  backchannel_authentication: https://auth.aiflow.solutions/bc-authorize
  mfa_challenge: https://auth.aiflow.solutions/mfa/challenge
grant_types_supported:
- client_credentials
- authorization_code
- refresh_token
- password
- implicit
- urn:ietf:params:oauth:grant-type:device_code
- urn:ietf:params:oauth:grant-type:token-exchange
- urn:ietf:params:oauth:grant-type:jwt-bearer
- http://auth0.com/oauth/grant-type/password-realm
- http://auth0.com/oauth/grant-type/passwordless/otp
- http://auth0.com/oauth/grant-type/mfa-oob
- http://auth0.com/oauth/grant-type/mfa-otp
- http://auth0.com/oauth/grant-type/mfa-recovery-code
token_endpoint_auth_methods_supported:
- client_secret_basic
- client_secret_post
- private_key_jwt
- none
security_features:
  pkce: true
  pkce_methods:
  - S256
  - plain
  dpop: true
  dpop_signing_alg_values_supported:
  - ES256
  mfa: true
  dynamic_client_registration: true
  token_revocation: true
  global_token_revocation: true
  id_token_signing_alg_values_supported:
  - HS256
  - RS256
  - PS256
observed:
  live_challenge: >-
    GET https://app.aiflow.solutions/ 302s to
    https://auth.aiflow.solutions/authorize with response_type=code, code_challenge_method=S256 and
    redirect_uri=https://app.veratainsight.com/auth/callback, then to the hosted universal-login page.
  fetched: '2026-09-14'
  http_status: 200