Pixis Authentication

generated: '2026-08-12'
method: probed
source: https://auth.pixis.ai/.well-known/openid-configuration
name: Pixis — authentication profile
description: >-
  Pixis publishes no public developer API and issues no public API keys. What it does publish,
  machine-readably, is an OpenID Connect / OAuth 2.0 discovery document at auth.pixis.ai — the
  Auth0 custom domain behind application login for Prism and the Pixis platform. The profile
  below is read verbatim from that document plus the Auth0Provider configuration Pixis ships in
  its own public Prism JavaScript bundle, and confirmed against the 401 an anonymous caller gets
  from the Pixis application backend.

scope_of_this_artifact: >-
  Application login for Pixis customers. This is NOT a developer-facing API authentication
  scheme — there is no published token flow for third-party integrators, no client registration
  a developer can self-serve, and no API reference to authenticate against.

authorization_server:
  issuer: https://auth.pixis.ai/
  platform: Auth0 (custom domain)
  discovery:
    openid_configuration: https://auth.pixis.ai/.well-known/openid-configuration
    oauth_authorization_server: https://auth.pixis.ai/.well-known/oauth-authorization-server
    jwks_uri: https://auth.pixis.ai/.well-known/jwks.json
  endpoints:
    authorization: https://auth.pixis.ai/authorize
    token: https://auth.pixis.ai/oauth/token
    userinfo: https://auth.pixis.ai/userinfo
    revocation: https://auth.pixis.ai/oauth/revoke
    device_authorization: https://auth.pixis.ai/oauth/device/code
    registration: https://auth.pixis.ai/oidc/register
    mfa_challenge: https://auth.pixis.ai/mfa/challenge

schemes:

  - id: oauth2_oidc
    type: oauth2
    protocol: OpenID Connect 1.0 / OAuth 2.0
    description: >-
      Authorization Code with PKCE is the flow the Pixis Prism SPA uses; the discovery document
      also advertises client_credentials, device_code, token-exchange and jwt-bearer.
    grant_types_supported:
      - authorization_code
      - client_credentials
      - refresh_token
      - implicit
      - password
      - urn:ietf:params:oauth:grant-type:device_code
      - urn:ietf:params:oauth:grant-type:token-exchange
      - urn:ietf:params:oauth:grant-type:jwt-bearer
      - http://auth0.com/oauth/grant-type/password-realm
      - http://auth0.com/oauth/grant-type/passwordless/otp
      - http://auth0.com/oauth/grant-type/mfa-oob
      - http://auth0.com/oauth/grant-type/mfa-otp
      - http://auth0.com/oauth/grant-type/mfa-recovery-code
    pkce:
      supported: true
      code_challenge_methods: [S256, plain]
    response_types_supported:
      - code
      - token
      - id_token
      - code token
      - code id_token
      - token id_token
      - code token id_token
    response_modes_supported: [query, fragment, form_post]
    token_endpoint_auth_methods_supported:
      - client_secret_basic
      - client_secret_post
      - private_key_jwt
      - none
    token_endpoint_auth_signing_alg_values_supported: [RS256, RS384, PS256]
    id_token_signing_alg_values_supported: [HS256, RS256, PS256]
    dpop_signing_alg_values_supported: [ES256]
    subject_types_supported: [public]
    dynamic_client_registration:
      endpoint: https://auth.pixis.ai/oidc/register
      note: >-
        Advertised by the discovery document. Auth0 gates this behind a per-tenant toggle;
        not probed with a write request.
    request_parameter_supported: false
    request_uri_parameter_supported: false
    mfa:
      supported: true
      evidence: mfa_challenge_endpoint plus four mfa-* grant types in the discovery document.

  - id: bearer_jwt_application_api
    type: http
    scheme: bearer
    bearer_format: JWT
    description: >-
      The Pixis application backend accepts a bearer JWT minted by the authorization server
      above. Anonymous requests are rejected by express-jwt with a `credentials_required` error.
    observed_on: https://core-performance.pixis.ai/
    evidence:
      request: GET https://core-performance.pixis.ai/ (no Authorization header)
      status: 401
      content_type: application/json; charset=utf-8
      body: >-
        {"error":{"name":"UnauthorizedError","message":"No authorization token was found",
        "code":"credentials_required","status":401,"inner":{"message":"No authorization token was found"}}}
    public: false
    note: >-
      This is the first-party backend for the Pixis web application, not a documented developer
      API. It is recorded because it is the only live, callable Pixis API host found and it
      states its own auth requirement plainly. No public reference or spec describes it.

client_configuration_observed:
  source: https://prism.pixis.ai/assets/index-Bof3QprB.js
  note: >-
    Pixis ships its Auth0 SPA configuration in a public, unminified-enough bundle. Values below
    are public-by-design SPA client parameters, not secrets.
  domain: auth.pixis.ai
  audience: https://cross-platform-prod.us.auth0.com/api/v2/
  scopes_requested: [openid, profile, email, offline_access]
  cache_location: localstorage
  use_refresh_tokens: true

api_keys:
  supported: false
  note: >-
    No API key issuance, key prefix, key management screen, or key documentation was found on
    any Pixis public surface.

mtls:
  supported: false

gaps:
  - No public developer authentication documentation.
  - No OAuth scopes documented for a Pixis API — the scopes_supported list is the stock Auth0
    OIDC profile-claim set, not a Pixis resource permission model.
  - No /.well-known/oauth-protected-resource (RFC 9728) on any host, so an agent cannot discover
    which resource server the authorization server protects.
  - No security.txt on any host, including auth.pixis.ai.