Aol Authentication

generated: '2026-09-02'
method: probed
source: https://api.login.aol.com/.well-known/openid-configuration
docs: https://developer.yahoo.com/oauth2/guide/openid_connect/
note: >-
  Upgraded from derived to probed. The baseline was derived from this repo's
  OpenAPI securitySchemes, which name the legacy Yahoo identity host. AOL runs
  its OWN OpenID Connect provider at api.login.aol.com and publishes a full
  discovery document there whose issuer is "https://api.login.aol.com" — the
  values below are read from that document, not from the spec. The Yahoo host
  is retained as a sibling deployment of the same Oath-era identity platform.
summary:
  types:
  - oauth2
  - openIdConnect
  - http
  oauth2_flows:
  - authorizationCode
  provider_type: OpenID Connect Provider (OpenID Connect Discovery 1.0)
  issuer: https://api.login.aol.com
  mfa_signalled: true
schemes:
- name: oauth2
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://api.login.aol.com/oauth2/request_auth
    tokenUrl: https://api.login.aol.com/oauth2/get_token
    refreshUrl: https://api.login.aol.com/oauth2/get_token
    scopes: 4
  sources:
  - https://api.login.aol.com/.well-known/openid-configuration
- name: openIdConnect
  type: openIdConnect
  openIdConnectUrl: https://api.login.aol.com/.well-known/openid-configuration
  sources:
  - https://api.login.aol.com/.well-known/openid-configuration
- name: basicAuth
  type: http
  scheme: basic
  description: >-
    client_secret_basic — HTTP Basic with base64-encoded `client_id:client_secret`
    at the token endpoint.
  sources:
  - https://api.login.aol.com/.well-known/openid-configuration
  - openapi/aol-oauth2-api-openapi.yml
- name: bearerAuth
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: OAuth 2.0 Bearer access token presented to the userinfo endpoint.
  sources:
  - openapi/aol-openid-connect-api-openapi.yml
endpoints:
  issuer: https://api.login.aol.com
  authorization: https://api.login.aol.com/oauth2/request_auth
  token: https://api.login.aol.com/oauth2/get_token
  userinfo: https://api.login.aol.com/openid/v1/userinfo
  jwks: https://api.login.aol.com/openid/v1/certs
  introspection: https://api.login.aol.com/oauth2/introspect
  revocation: https://api.login.aol.com/oauth2/revoke
token_endpoint_auth_methods:
- client_secret_basic
- client_secret_post
grant_types:
- authorization_code
- refresh_token
response_types:
- code
- token
- id_token
- code token
- code id_token
- token id_token
- code token id_token
response_modes:
- query
id_token_signing_algs:
- ES256
- RS256
subject_types:
- public
acr_values:
- AAL1
- AAL2
claims:
- aud
- auth_time
- birthdate
- email
- email_verified
- exp
- family_name
- given_name
- iat
- iss
- locale
- name
- sub
not_supported:
  claims_parameter: false
  request_parameter: false
  request_uri_parameter: false
  note: >-
    Signed/pushed request objects (RFC 9101) and the OIDC `claims` request
    parameter are explicitly unsupported per the discovery document.
evidence:
- url: https://api.login.aol.com/.well-known/openid-configuration
  status: 200
  content_type: application/json
  fetched: '2026-09-02'
- url: https://api.login.aol.com/openid/v1/certs
  status: 200
  content_type: application/json
  fetched: '2026-09-02'
  note: JWKS served anonymously; RSA/RS256 signing keys present.
- url: https://api.login.aol.com/oauth2/introspect
  status: 403
  fetched: '2026-09-02'
  note: Introspection endpoint exists per discovery but rejects anonymous callers.