Leap Finance Authentication

generated: '2026-08-25'
method: probed
source: >-
  https://auth.leapfinance.com/.well-known/openid-configuration (HTTP 200,
  application/json, 2523 bytes, fetched 2026-08-25) — saved verbatim to
  well-known/leap-finance-openid-configuration.json
name: Leap Finance authentication
description: >-
  Authentication profile for Leap Finance Inc., established entirely by probing the
  company's own identity tenant. Leap Finance publishes no API reference and no
  OpenAPI document, so there are no securitySchemes to derive from. What it does
  serve is a complete, unauthenticated OpenID Connect discovery document at
  auth.leapfinance.com — an Auth0 tenant on the company's own domain — which
  describes the identity surface behind its consumer loan application and partner
  portal.

caveat: >-
  This describes an END-USER IDENTITY surface, not a developer API authentication
  model. The endpoints below authenticate borrowers and partner-portal operators into
  Leap Finance's own web applications. No public API accepts these tokens, because no
  public API is documented. Do not read this artifact as evidence that Leap Finance
  offers programmatic access.

provider: Auth0
issuer: https://auth.leapfinance.com/
tenant_cname: auth-leapfinance-cd-gp8aezmavuzbqnge.edge.tenants.auth0.com

schemes:
  - id: openIdConnect
    type: openIdConnect
    openIdConnectUrl: https://auth.leapfinance.com/.well-known/openid-configuration
    description: >-
      OpenID Connect 1.0, discovered live. Also served, byte-identical, at the RFC
      8414 path /.well-known/oauth-authorization-server.
  - id: oauth2
    type: oauth2
    description: OAuth 2.0 authorization server fronting the same tenant.
    flows:
      authorizationCode:
        authorizationUrl: https://auth.leapfinance.com/authorize
        tokenUrl: https://auth.leapfinance.com/oauth/token
        refreshUrl: https://auth.leapfinance.com/oauth/token
      clientCredentials:
        tokenUrl: https://auth.leapfinance.com/oauth/token
      deviceCode:
        deviceAuthorizationUrl: https://auth.leapfinance.com/oauth/device/code
        tokenUrl: https://auth.leapfinance.com/oauth/token
      implicit:
        authorizationUrl: https://auth.leapfinance.com/authorize
        note: >-
          Advertised but deprecated by OAuth 2.1; listed here because the tenant
          declares it, not because it is recommended.

endpoints:
  authorization: https://auth.leapfinance.com/authorize
  token: https://auth.leapfinance.com/oauth/token
  userinfo: https://auth.leapfinance.com/userinfo
  jwks: https://auth.leapfinance.com/.well-known/jwks.json
  revocation: https://auth.leapfinance.com/oauth/revoke
  registration: https://auth.leapfinance.com/oidc/register
  device_authorization: https://auth.leapfinance.com/oauth/device/code
  backchannel_authentication: https://auth.leapfinance.com/bc-authorize
  mfa_challenge: https://auth.leapfinance.com/mfa/challenge
  global_token_revocation: https://auth.leapfinance.com/oauth/global-token-revocation/connection/{connectionName}

grant_types_supported:
  - client_credentials
  - authorization_code
  - refresh_token
  - password
  - implicit
  - urn:ietf:params:oauth:grant-type:device_code
  - urn:ietf:params:oauth:grant-type:token-exchange
  - urn:ietf:params:oauth:grant-type:jwt-bearer
  - http://auth0.com/oauth/grant-type/password-realm
  - http://auth0.com/oauth/grant-type/passwordless/otp
  - http://auth0.com/oauth/grant-type/mfa-oob
  - http://auth0.com/oauth/grant-type/mfa-otp
  - http://auth0.com/oauth/grant-type/mfa-recovery-code

client_authentication:
  token_endpoint_auth_methods_supported:
    - client_secret_basic
    - client_secret_post
    - private_key_jwt
    - none
  token_endpoint_auth_signing_alg_values_supported: [RS256, RS384, PS256]

token_security:
  pkce:
    supported: true
    code_challenge_methods_supported: [S256, plain]
    note: >-
      S256 is supported. `plain` is also advertised, which RFC 7636 permits but
      discourages for clients capable of S256.
  dpop:
    supported: true
    dpop_signing_alg_values_supported: [ES256]
  id_token_signing_alg_values_supported: [HS256, RS256, PS256]
  note: >-
    HS256 is advertised for ID token signing alongside RS256/PS256. HS256 is a
    symmetric algorithm and is only appropriate for confidential clients.

mfa:
  supported: true
  evidence: >-
    mfa_challenge_endpoint plus the mfa-oob / mfa-otp / mfa-recovery-code grant types
    in the discovery document.

registration:
  dynamic_client_registration: true
  endpoint: https://auth.leapfinance.com/oidc/register
  note: >-
    RFC 7591 dynamic client registration endpoint is advertised. Whether it is open
    or requires an initial access token was NOT tested — this pipeline does not
    attempt registration against a live identity tenant.

subject_types_supported: [public]
response_modes_supported: [query, fragment, form_post]
response_types_supported:
  - code
  - token
  - id_token
  - code token
  - code id_token
  - token id_token
  - code token id_token

request_object:
  request_parameter_supported: false
  request_uri_parameter_supported: false

claims_supported:
  - aud
  - auth_time
  - created_at
  - email
  - email_verified
  - exp
  - family_name
  - given_name
  - iat
  - identities
  - iss
  - name
  - nickname
  - phone_number
  - picture
  - sub

scopes:
  reference: scopes/leap-finance-scopes.yml

other_hosts:
  - host: api.leapscholar.com
    observed: >-
      Rejects all unauthenticated requests. Returns HTTP 403 with an empty body on
      /, /v1/* and every /.well-known/* path, and HTTP 400 application/problem+json
      on other paths. No WWW-Authenticate header is returned, so the expected
      credential type is not advertised. Authentication model undetermined.
  - host: partner.leapfinance.com
    observed: >-
      React single-page application titled "Leap Finance" that renders nothing
      without JavaScript. A partner portal login; no machine-readable auth metadata.
  - host: portal.leapfinance.com
    observed: >-
      Next.js application whose served body is "Home Visit CMS Login" — an internal
      operations CMS. Not a developer surface.