Annexus Health Authentication

generated: '2026-08-06'
method: searched
source: https://login.live.annexushealth.com/.well-known/openid-configuration
docs: https://www.annexushealth.com/privacy-security/
summary: >-
  Annexus Health fronts the AssistPoint platform with an OpenID Connect / OAuth 2.0
  authorization server on its own custom domain, login.live.annexushealth.com. The discovery
  document is served anonymously and is the only machine-readable authentication contract the
  company publishes; the AssistPoint business API it protects is partner-gated and has no
  public reference. The tenant is Auth0-hosted, evidenced by the Auth0-namespaced grant types
  (http://auth0.com/oauth/grant-type/*) and the /mfa/challenge endpoint in the discovery
  document.
issuer: https://login.live.annexushealth.com/
security_schemes:
- name: assistpoint_oidc
  type: openIdConnect
  openIdConnectUrl: https://login.live.annexushealth.com/.well-known/openid-configuration
  description: >-
    OpenID Connect Discovery 1.0 metadata for the AssistPoint production identity tier.
- name: assistpoint_oauth2
  type: oauth2
  flows:
    authorizationCode:
      authorizationUrl: https://login.live.annexushealth.com/authorize
      tokenUrl: https://login.live.annexushealth.com/oauth/token
      refreshUrl: https://login.live.annexushealth.com/oauth/token
      scopes_ref: scopes/annexus-health-scopes.yml
    clientCredentials:
      tokenUrl: https://login.live.annexushealth.com/oauth/token
      scopes_ref: scopes/annexus-health-scopes.yml
    deviceCode:
      deviceAuthorizationUrl: https://login.live.annexushealth.com/oauth/device/code
      tokenUrl: https://login.live.annexushealth.com/oauth/token
endpoints:
  authorization: https://login.live.annexushealth.com/authorize
  token: https://login.live.annexushealth.com/oauth/token
  userinfo: https://login.live.annexushealth.com/userinfo
  jwks: https://login.live.annexushealth.com/.well-known/jwks.json
  registration: https://login.live.annexushealth.com/oidc/register
  revocation: https://login.live.annexushealth.com/oauth/revoke
  device_authorization: https://login.live.annexushealth.com/oauth/device/code
  mfa_challenge: https://login.live.annexushealth.com/mfa/challenge
  backchannel_authentication: https://login.live.annexushealth.com/bc-authorize
  global_token_revocation: https://login.live.annexushealth.com/oauth/global-token-revocation/connection/{connectionName}
grant_types:
- client_credentials
- authorization_code
- refresh_token
- password
- implicit
- urn:ietf:params:oauth:grant-type:device_code
- urn:ietf:params:oauth:grant-type:token-exchange
- urn:ietf:params:oauth:grant-type:jwt-bearer
- http://auth0.com/oauth/grant-type/password-realm
- http://auth0.com/oauth/grant-type/passwordless/otp
- http://auth0.com/oauth/grant-type/mfa-oob
- http://auth0.com/oauth/grant-type/mfa-otp
- http://auth0.com/oauth/grant-type/mfa-recovery-code
client_authentication:
- client_secret_basic
- client_secret_post
- private_key_jwt
- none
token_signing:
  id_token_alg_values: [HS256, RS256, PS256]
  token_endpoint_auth_signing_alg_values: [RS256, RS384, PS256]
  dpop_signing_alg_values: [ES256]
hardening:
  pkce: true
  pkce_methods: [S256, plain]
  pkce_plain_still_offered: true
  dpop: true
  mfa: true
  dynamic_client_registration: true
  backchannel_logout: true
  backchannel_logout_session: true
  token_revocation: true
  request_object_support: false
  request_uri_support: false
  private_key_jwt: true
observations:
- >-
  Both S256 and plain are advertised as PKCE challenge methods; plain offers no protection
  against an authorization-code interception attack and is only present for legacy clients.
- >-
  The deprecated ROPC (password) and implicit grants remain enabled alongside the modern
  authorization_code + PKCE and client_credentials grants.
- >-
  HS256 is advertised for ID token signing alongside RS256/PS256; symmetric ID token signing
  is discouraged for public clients.
- >-
  No per-API resource scopes are advertised — the fourteen advertised scopes are the standard
  OIDC profile set. Any AssistPoint / AP Connect resource scopes are issued per partner and
  are not published.
x-evidence:
  fetched: '2026-08-06'
  url: https://login.live.annexushealth.com/.well-known/openid-configuration
  http_status: 200
  content_type: application/json; charset=utf-8