Iralogix Authentication

generated: '2026-08-04'
method: probed
source: https://auth.partner.iralogix.com/.well-known/openid-configuration
docs: null
notes: 'Derived entirely from the live OIDC discovery document IRALOGIX publishes for
  its partner platform. There is no public OpenAPI to derive securitySchemes from —
  the partner documentation (docs.iralogix.com) is behind Okta visitor authentication
  and the partner console (partner.iralogix.com) behind this Auth0 tenant. A second,
  separate Okta org (iralogix.okta.com) fronts the documentation site itself.'
summary:
  types:
  - openIdConnect
  - oauth2
  oauth2_flows:
  - authorizationCode
  - clientCredentials
  - implicit
  - password
  - deviceCode
  - tokenExchange
  - jwtBearer
  api_key_in: []
  pkce: true
  mfa: true
  dynamic_client_registration: true
schemes:
- name: IRALOGIX Partner OIDC
  type: openIdConnect
  openIdConnectUrl: https://auth.partner.iralogix.com/.well-known/openid-configuration
  issuer: https://auth.partner.iralogix.com/
  vendor: Auth0
  sources:
  - well-known/iralogix-openid-configuration.json
  endpoints:
    authorization: https://auth.partner.iralogix.com/authorize
    token: https://auth.partner.iralogix.com/oauth/token
    device_authorization: https://auth.partner.iralogix.com/oauth/device/code
    userinfo: https://auth.partner.iralogix.com/userinfo
    mfa_challenge: https://auth.partner.iralogix.com/mfa/challenge
    jwks: https://auth.partner.iralogix.com/.well-known/jwks.json
    registration: https://auth.partner.iralogix.com/oidc/register
    revocation: https://auth.partner.iralogix.com/oauth/revoke
    end_session: https://auth.partner.iralogix.com/oidc/logout
    backchannel_authentication: present
    global_token_revocation: present
  grant_types_supported:
  - client_credentials
  - authorization_code
  - refresh_token
  - password
  - implicit
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:ietf:params:oauth:grant-type:token-exchange
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  - http://auth0.com/oauth/grant-type/password-realm
  - http://auth0.com/oauth/grant-type/passwordless/otp
  - http://auth0.com/oauth/grant-type/mfa-oob
  - http://auth0.com/oauth/grant-type/mfa-otp
  - http://auth0.com/oauth/grant-type/mfa-recovery-code
  response_types_supported:
  - code
  - token
  - id_token
  - code token
  - code id_token
  - token id_token
  - code token id_token
  response_modes_supported:
  - query
  - fragment
  - form_post
  token_endpoint_auth_methods_supported:
  - client_secret_basic
  - client_secret_post
  - private_key_jwt
  - none
  token_endpoint_auth_signing_alg_values_supported:
  - RS256
  - RS384
  - PS256
  id_token_signing_alg_values_supported:
  - HS256
  - RS256
  - PS256
  code_challenge_methods_supported:
  - S256
  - plain
  subject_types_supported:
  - public
  backchannel_logout_supported: true
  backchannel_logout_session_supported: true
  request_parameter_supported: false
  request_uri_parameter_supported: false
  dpop_supported: true
observations:
- id: pkce-s256
  note: PKCE S256 is advertised; `plain` is also still advertised, which RFC 7636 §4.2
    discourages for clients able to do S256.
- id: implicit-and-password-grants
  note: The implicit and resource-owner-password grants remain enabled on the tenant.
    OAuth 2.1 and the Auth0 defaults both deprecate these; a partner-facing financial
    platform would normally disable both.
- id: private-key-jwt
  note: private_key_jwt client authentication is supported, which is the FAPI-preferred
    method for confidential clients.
- id: no-par
  note: No pushed_authorization_request_endpoint and no request_object_signing_alg_values_supported
    — PAR and signed request objects are not advertised, so the tenant is not FAPI 2.0
    profile-ready as configured.
x-evidence:
  fetched: '2026-08-04'
  url: https://auth.partner.iralogix.com/.well-known/openid-configuration
  http_status: 200
  content_type: application/json