Century Communities Authentication

generated: '2026-09-14'
method: probed
source: https://www.centurycommunities.com/.well-known/openid-configuration
provider: Century Communities
providerId: century-communities
description: >-
  Century Communities publishes no developer portal and no hand-written authentication
  guide. This profile is read entirely from the OpenID Connect discovery document the
  company's own host serves at /.well-known/openid-configuration (HTTP 200,
  application/json, probed 2026-09-14), plus the JWKS it points at. Every value below is
  copied from that document; nothing is inferred.
ownership_note: >-
  The authorization server is the one built into Optimizely (Episerver) CMS, which Century
  Communities runs its public site on. It is a first-party surface in the sense that
  matters here: the issuer is https://www.centurycommunities.com/, and every endpoint the
  document names lives under that host and is operated by Century Communities. The
  software is the vendor's; the deployment, the keys and the tokens are the company's.
schemes:
  - id: openid-connect
    type: openIdConnect
    name: OpenID Connect / OAuth 2.0 (Optimizely CMS)
    openIdConnectUrl: https://www.centurycommunities.com/.well-known/openid-configuration
    issuer: https://www.centurycommunities.com/
    endpoints:
      authorization: https://www.centurycommunities.com/api/episerver/connect/authorize
      token: https://www.centurycommunities.com/api/episerver/connect/token
      userinfo: https://www.centurycommunities.com/api/episerver/connect/userinfo
      end_session: https://www.centurycommunities.com/api/episerver/connect/logout
      jwks: https://www.centurycommunities.com/.well-known/jwks
    grant_types:
      - authorization_code
      - refresh_token
      - client_credentials
    response_types:
      - code
    response_modes:
      - form_post
      - fragment
      - query
    pkce:
      supported: true
      code_challenge_methods:
        - S256
    token_endpoint_auth_methods:
      - client_secret_basic
      - client_secret_post
    id_token_signing_alg:
      - RS256
    claims:
      - aud
      - exp
      - iat
      - iss
      - sub
      - profile
      - email
      - role
    subject_types:
      - public
    parameters:
      claims_parameter_supported: false
      request_parameter_supported: false
      request_uri_parameter_supported: false
    credential_issuance: >-
      Not public. There is no self-service sign-up, client registration endpoint, or
      developer portal; the discovery document advertises no registration_endpoint, so
      clients must be provisioned by Century Communities.
anonymous_surface:
  note: >-
    The Optimizely Content Delivery API on the same host answers unauthenticated. Probed
    2026-09-14: GET /api/episerver/v3.0/site returned HTTP 200 with the live site
    definition, and GET /api/episerver/v3.0/content/5 returned HTTP 200 with the home-page
    content tree. No key, no token, no Authorization header.
  endpoints_probed:
    - url: https://www.centurycommunities.com/api/episerver/v3.0/site
      status: 200
    - url: https://www.centurycommunities.com/api/episerver/v3.0/content/5
      status: 200
gaps:
  - No first-party authentication documentation of any kind.
  - No dynamic client registration endpoint advertised.
  - No /.well-known/oauth-protected-resource document (404 on every host probed).
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com