Firefly Authentication

generated: '2026-08-12'
method: probed
source: https://auth.fireflyon.com/.well-known/openid-configuration
docs: null
scope_of_this_artifact: >-
  This describes the identity layer in front of the Firefly advertiser dashboard
  (app.fireflyon.com) and its API gateway (app-gw.api.fireflyon.com) — NOT a public
  Firefly developer API. Firefly publishes no developer portal, no API reference and
  no OpenAPI; see x-coverage in apis.yml. The document below was read verbatim from a
  live, unauthenticated GET of the OpenID Connect discovery endpoint on Firefly's own
  auth host, so every value here is Firefly-served fact rather than derivation.
  The endpoint set is an Auth0 custom-domain tenant
  (auth.fireflyon.com CNAME -> fireflyon-cd-p4enovzjyobijetz.edge.tenants.auth0.com),
  which means the surface reflects Auth0 platform defaults; Firefly-specific choices
  cannot be separated from platform defaults without authenticated access.
summary:
  types:
  - oauth2
  - openIdConnect
  primary: OpenID Connect (Authorization Code + PKCE) against an Auth0 custom-domain tenant
  api_key_auth: false
  mutual_tls: false
schemes:
- name: firefly-dashboard-oidc
  type: openIdConnect
  openIdConnectUrl: https://auth.fireflyon.com/.well-known/openid-configuration
  issuer: https://auth.fireflyon.com/
  description: >-
    OpenID Connect discovery for the Firefly advertiser dashboard tenant. Verified live
    2026-08-12, HTTP 200, application/json, 2,501 bytes. Saved verbatim at
    well-known/firefly-openid-configuration.json. The RFC 8414 OAuth authorization-server
    metadata document at /.well-known/oauth-authorization-server is byte-identical.
  endpoints:
    authorization: https://auth.fireflyon.com/authorize
    token: https://auth.fireflyon.com/oauth/token
    userinfo: https://auth.fireflyon.com/userinfo
    jwks: https://auth.fireflyon.com/.well-known/jwks.json
    revocation: https://auth.fireflyon.com/oauth/revoke
    device_authorization: https://auth.fireflyon.com/oauth/device/code
    dynamic_client_registration: https://auth.fireflyon.com/oidc/register
    backchannel_authentication: https://auth.fireflyon.com/bc-authorize
    mfa_challenge: https://auth.fireflyon.com/mfa/challenge
  grant_types:
  - authorization_code
  - client_credentials
  - refresh_token
  - implicit
  - password
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:ietf:params:oauth:grant-type:token-exchange
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  - http://auth0.com/oauth/grant-type/password-realm
  - http://auth0.com/oauth/grant-type/passwordless/otp
  - http://auth0.com/oauth/grant-type/mfa-oob
  - http://auth0.com/oauth/grant-type/mfa-otp
  - http://auth0.com/oauth/grant-type/mfa-recovery-code
  response_types:
  - code
  - token
  - id_token
  - code token
  - code id_token
  - token id_token
  - code token id_token
  response_modes:
  - query
  - fragment
  - form_post
  pkce:
    supported: true
    code_challenge_methods:
    - S256
    - plain
  token_endpoint_auth_methods:
  - client_secret_basic
  - client_secret_post
  - private_key_jwt
  - none
  token_endpoint_auth_signing_algs:
  - RS256
  - RS384
  - PS256
  id_token_signing_algs:
  - HS256
  - RS256
  - PS256
  subject_types:
  - public
  claims:
  - aud
  - auth_time
  - created_at
  - email
  - email_verified
  - exp
  - family_name
  - given_name
  - iat
  - identities
  - iss
  - name
  - nickname
  - phone_number
  - picture
  - sub
  scopes: scopes/firefly-scopes.yml
audiences:
- audience: https://gw.fireflyon.com
  used_by: https://app.fireflyon.com (Firefly advertiser dashboard SPA)
  source: >-
    window.REACT_APP_AUTH0_AUDIENCE in the public SPA runtime config at
    https://app.fireflyon.com/config.js (HTTP 200). The audience hostname
    gw.fireflyon.com does not itself resolve in DNS; the gateway the SPA calls is
    https://app-gw.api.fireflyon.com.
  note: >-
    Access tokens minted for this audience are what the advertiser dashboard presents to
    app-gw.api.fireflyon.com. That gateway answers 404 text/plain "404 page not found"
    to every unauthenticated path probed, so its operation set cannot be read without
    an advertiser account.
gaps:
- id: no-public-auth-documentation
  detail: >-
    Firefly publishes no authentication guide, no key/credential issuance page and no
    developer portal. The only machine-readable auth surface is the Auth0 discovery
    document above, which is platform-generated rather than Firefly-authored prose.
  evidence:
  - url: https://www.fireflyon.com/sitemap.xml
    status: 200
    note: 90 URLs, none developer- or API-facing.
- id: no-protected-resource-metadata
  detail: >-
    No RFC 9728 OAuth protected-resource metadata is served by the gateway, so a client
    cannot discover which authorization server protects app-gw.api.fireflyon.com without
    reading the SPA config.
  evidence:
  - url: https://app-gw.api.fireflyon.com/.well-known/oauth-protected-resource
    status: 404
x-evidence:
  fetched: '2026-08-12'
  probes:
  - url: https://auth.fireflyon.com/.well-known/openid-configuration
    status: 200
  - url: https://auth.fireflyon.com/.well-known/oauth-authorization-server
    status: 200
  - url: https://auth.fireflyon.com/.well-known/zzz-nonexistent-abc
    status: 404
    note: control probe — this host does not answer /.well-known/* with a catch-all.
  - url: https://app-gw.api.fireflyon.com/.well-known/oauth-protected-resource
    status: 404