Fusio Authentication

generated: '2026-08-29'
method: searched
source: openapi/fusio-authorization.json, openapi/fusio-backend.json, openapi/fusio-consumer.json, openapi/fusio-system.json;
  enriched from https://docs.fusio-project.org/docs/security/authentication, https://docs.fusio-project.org/docs/security/authorization,
  https://docs.fusio-project.org/docs/security/personal_access_token and https://demo.fusio-project.org/.well-known/oauth-authorization-server
summary:
  types:
  - oauth2
  oauth2_flows:
  - authorizationCode
  - clientCredentials
schemes:
- name: app
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: https://demo.fusio-project.org/authorization/token
    scopes: 2
  - flow: authorizationCode
    authorizationUrl: https://demo.fusio-project.org/authorization/authorize
    tokenUrl: https://demo.fusio-project.org/authorization/token
    scopes: 2
  sources:
  - openapi/fusio-authorization.json
  - openapi/fusio-backend.json
  - openapi/fusio-consumer.json
  - openapi/fusio-system.json
docs: https://docs.fusio-project.org/docs/security/authentication
provider: Fusio
providerId: fusio
description: Fusio ships its own OAuth2 authorization server (added in 6.0.0) rather than delegating to
  one, and publishes RFC 8414, RFC 9728 and OpenID Connect discovery documents from every instance. The
  single securityScheme in the generated contracts is thin - it advertises only the 'default' scope because
  the generator emits what the anonymous caller can see - so the real model below is read from the docs
  and the discovery documents, not from the spec alone.
methods:
- name: OAuth2 authorization server
  endpoint: /authorization/token
  grants:
  - authorization_code
  - client_credentials
  - password
  - refresh_token
  authorization_endpoint: /authorization/authorize
  token_endpoint_auth_methods:
  - client_secret_basic
  signing_alg: HS256
  docs: https://docs.fusio-project.org/docs/security/authorization
  note: The full path. Client id and secret come from an app created in the backend; every redirect URI
    must share the app URL base.
- name: Simple login
  endpoint: /consumer/login
  http: POST
  payload: '{"username": "...", "password": "..."}'
  returns: a JWT access token
  refresh: PUT /consumer/login
  docs: https://docs.fusio-project.org/docs/security/authentication
  note: The shortest path to a token, intended for an operator’s own SPA.
- name: Personal access token
  endpoint: /consumer/token
  http: POST
  operationId: consumer.token.create
  scoped: true
  docs: https://docs.fusio-project.org/docs/security/personal_access_token
  note: GitHub-style manually created token with a chosen subset of scopes. The right choice for machine-to-machine
    use.
- name: External OIDC identity provider
  endpoint: /consumer/identity
  docs: https://docs.fusio-project.org/docs/security/authentication
  note: Fusio is also an OIDC relying party. Identity providers such as Keycloak, Entra ID or Okta are
    configured under System / Identity and bound to an app; the callback returns access_token, token_type,
    expires_in, refresh_token and scope as query parameters on the app redirect_uri.
token:
  transport: 'Authorization: Bearer <token>'
  bearer_methods_supported:
  - header
  expiry: instance-configurable; every token expires
  refresh: refresh_token grant or PUT /consumer/login
  revocation: POST /authorization/revoke (self), DELETE /backend/app/{app_id}/token/{token_id} (operator),
    DELETE /consumer/token/{token_id} (consumer)
  introspection: GET /authorization/whoami returns the identity a token resolves to
discovery:
  oauth_authorization_server: well-known/fusio-oauth-authorization-server.json
  oauth_protected_resource: well-known/fusio-oauth-protected-resource.json
  openid_configuration: well-known/fusio-openid-configuration.json
  claims_supported:
  - iss
  - sub
  - iat
  - exp
  - name
  - preferred_username
  - aud
  - email
scopes_detail: scopes/fusio-scopes.yml
spec_gap: The harvested contracts declare the oauth2 scheme with only the 'default' scope, because the
  OpenAPI is generated live for the anonymous caller. The instance actually defines 58 scopes, recovered
  from the filtered per-category specs and recorded in scopes/fusio-scopes.yml.
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com