Eon Next Authentication

generated: '2026-07-27'
method: searched
source: https://auth.eonnext.com/.well-known/openid-configuration
docs: null
docs_note: >-
  There is no human-readable authentication documentation. Everything below was
  read out of the authorization server's own anonymous discovery document
  (HTTP 200 on 2026-07-27), not out of a developer portal — E.ON Next publishes
  none.
description: >-
  E.ON Next has exactly one publicly describable authentication surface, and it
  is customer sign-in, not developer access: an OpenID Connect / OAuth 2.0
  authorization server at https://auth.eonnext.com/, run on Auth0 as the E.ON
  group CIAM tenant (certificate CN eon-next-uk.eon-ciam.auth0app.com, Cloudflare
  edge, Let's Encrypt certificate). Its RFC 8414 / OIDC Discovery metadata is
  served anonymously and completely, so the grant types, endpoints, signing keys
  and client-authentication methods below are observed fact rather than
  inference. What the discovery document does NOT imply is a developer
  programme: there is no published client registration path for a third party,
  no API-key programme, no partner onboarding and no documented resource server.
  The application-facing hosts api.eonnext.com and data.eonnext.com sit behind
  AWS API Gateway and answer every anonymous request with
  {"message":"Missing Authentication Token"} (HTTP 403), disclosing no scheme at
  all. Treat this artifact as "how an E.ON Next customer's browser or app
  authenticates", not "how you get an API credential".
summary:
  types: [openIdConnect, oauth2]
  api_key_in: []
  oauth2_flows: [authorizationCode, implicit, clientCredentials, password, deviceCode, refreshToken, tokenExchange, ciba]
  third_party_access: none-published
schemes:
- name: eon-next-ciam-oidc
  type: openIdConnect
  openIdConnectUrl: https://auth.eonnext.com/.well-known/openid-configuration
  issuer: https://auth.eonnext.com/
  vendor: Auth0 (Okta) — E.ON group CIAM tenant "eon-ciam", application "eon-next-uk"
  sources: [well-known/eon-next-openid-configuration.json]
  endpoints:
    authorization: https://auth.eonnext.com/authorize
    token: https://auth.eonnext.com/oauth/token
    userinfo: https://auth.eonnext.com/userinfo
    jwks: https://auth.eonnext.com/.well-known/jwks.json
    registration: https://auth.eonnext.com/oidc/register
    revocation: https://auth.eonnext.com/oauth/revoke
    end_session: https://auth.eonnext.com/oidc/logout
    device_authorization: https://auth.eonnext.com/oauth/device/code
    backchannel_authentication: https://auth.eonnext.com/bc-authorize
    mfa_challenge: https://auth.eonnext.com/mfa/challenge
    global_token_revocation: https://auth.eonnext.com/oauth/global-token-revocation/connection/{connectionName}
    pushed_authorization_request: null
  grant_types_supported:
  - authorization_code
  - client_credentials
  - refresh_token
  - password
  - implicit
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:ietf:params:oauth:grant-type:token-exchange
  - http://auth0.com/oauth/grant-type/password-realm
  - http://auth0.com/oauth/grant-type/passwordless/otp
  - http://auth0.com/oauth/grant-type/mfa-oob
  - http://auth0.com/oauth/grant-type/mfa-otp
  - http://auth0.com/oauth/grant-type/mfa-recovery-code
  response_types_supported: [code, token, id_token, code token, code id_token, token id_token, code token id_token]
  response_modes_supported: [query, fragment, form_post]
  code_challenge_methods_supported: [S256, plain]
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  - client_secret_post
  - private_key_jwt
  - tls_client_auth
  - self_signed_tls_client_auth
  - none
  token_endpoint_auth_signing_alg_values_supported: [RS256, RS384, PS256]
  id_token_signing_alg_values_supported: [HS256, RS256, PS256]
  request_object_signing_alg_values_supported: [RS256, RS384, PS256]
  dpop_signing_alg_values_supported: [ES256]
  tls_client_certificate_bound_access_tokens: true
  request_parameter_supported: true
  request_uri_parameter_supported: false
  backchannel_logout_supported: true
  backchannel_token_delivery_modes_supported: [poll]
  subject_types_supported: [public]
  claims_supported: [aud, auth_time, created_at, email, email_verified, exp, family_name, given_name, iat, identities, iss, name, nickname, phone_number, picture, sub]
  scopes: see scopes/eon-next-scopes.yml
  mfa: >-
    Multi-factor is a first-class part of this tenant — a dedicated
    /mfa/challenge endpoint plus mfa-oob, mfa-otp and mfa-recovery-code grants.
  keys:
    jwks_file: well-known/eon-next-jwks.json
    key_count: 2
    algorithms: [RS256]
- name: aws-api-gateway-undisclosed
  type: unknown
  hosts: [https://api.eonnext.com, https://data.eonnext.com]
  observed: >-
    HTTP 403 with the 42-byte body {"message":"Missing Authentication Token"} on
    every probed path, including /.well-known/*, /openapi.json, /graphql and
    /health. This is the canonical AWS API Gateway response for an unmatched or
    unauthorised route. It proves a gateway is deployed; it discloses neither the
    authorizer type nor any credential model.
  documented: false
notes:
- >-
  A registration_endpoint (/oidc/register) is advertised, which is OAuth 2.0
  Dynamic Client Registration (RFC 7591). Auth0 advertises it whether or not the
  tenant permits open registration; it was NOT exercised, so no claim is made
  that a third party can self-register a client.
- >-
  No Pushed Authorization Request endpoint and no FAPI profile are advertised,
  so this is a mainstream CIAM configuration rather than a regulated
  open-banking/open-energy style deployment.
- >-
  Britain has no consumer energy data-portability mandate, so there is no
  regulated accreditation model (nothing equivalent to Australian CDR ADR
  accreditation or an FDX/OAuth data-sharing profile) sitting behind this server.
  See review.yml.