Rapiddeploy Authentication

generated: '2026-08-26'
method: probed
source: https://auth.rapiddeploy.com/.well-known/openid-configuration
docs: null
name: RapidDeploy authentication profile
description: >-
  RapidDeploy publishes no API reference and no OpenAPI securitySchemes, so this profile is built
  entirely from the anonymous OpenID Connect / RFC 8414 discovery documents served by the company's
  own Auth0 tenant at auth.rapiddeploy.com (issuer https://auth.rapiddeploy.com/). Everything below
  was read out of that document; nothing is inferred from marketing copy.
provider_hosts:
  api: https://api.rapiddeploy.com
  identity: https://auth.rapiddeploy.com
schemes:
- id: oauth2_authorization_code
  type: oauth2
  flow: authorizationCode
  authorization_url: https://auth.rapiddeploy.com/authorize
  token_url: https://auth.rapiddeploy.com/oauth/token
  pkce: true
  pkce_methods:
  - S256
  - plain
  note: 'Interactive agency/user sign-in for the RapidDeploy web applications.'
- id: oauth2_client_credentials
  type: oauth2
  flow: clientCredentials
  token_url: https://auth.rapiddeploy.com/oauth/token
  note: >-
    client_credentials is advertised in grant_types_supported, which is the machine-to-machine path
    an integrator would use against api.rapiddeploy.com. No public documentation describes the
    audience value or how credentials are issued - that is a tenant/partner process.
- id: oauth2_device_code
  type: oauth2
  flow: deviceCode
  device_authorization_url: https://auth.rapiddeploy.com/oauth/device/code
  token_url: https://auth.rapiddeploy.com/oauth/token
- id: openIdConnect
  type: openIdConnect
  openid_connect_url: https://auth.rapiddeploy.com/.well-known/openid-configuration
  issuer: https://auth.rapiddeploy.com/
  userinfo_endpoint: https://auth.rapiddeploy.com/userinfo
  jwks_uri: https://auth.rapiddeploy.com/.well-known/jwks.json
grant_types_supported:
- client_credentials
- authorization_code
- refresh_token
- password
- implicit
- urn:ietf:params:oauth:grant-type:device_code
- urn:ietf:params:oauth:grant-type:token-exchange
- urn:ietf:params:oauth:grant-type:jwt-bearer
- http://auth0.com/oauth/grant-type/password-realm
- http://auth0.com/oauth/grant-type/passwordless/otp
- http://auth0.com/oauth/grant-type/mfa-oob
- http://auth0.com/oauth/grant-type/mfa-otp
- http://auth0.com/oauth/grant-type/mfa-recovery-code
token_endpoint_auth_methods_supported:
- client_secret_basic
- client_secret_post
- private_key_jwt
- none
token_signing:
  id_token_signing_alg_values_supported:
  - HS256
  - RS256
  - PS256
  token_endpoint_auth_signing_alg_values_supported:
  - RS256
  - RS384
  - PS256
  dpop_signing_alg_values_supported:
  - ES256
endpoints:
  authorization: https://auth.rapiddeploy.com/authorize
  token: https://auth.rapiddeploy.com/oauth/token
  userinfo: https://auth.rapiddeploy.com/userinfo
  revocation: https://auth.rapiddeploy.com/oauth/revoke
  registration: https://auth.rapiddeploy.com/oidc/register
  device_authorization: https://auth.rapiddeploy.com/oauth/device/code
  mfa_challenge: https://auth.rapiddeploy.com/mfa/challenge
  backchannel_authentication: https://auth.rapiddeploy.com/bc-authorize
  jwks: https://auth.rapiddeploy.com/.well-known/jwks.json
capabilities:
  mfa: true
  dpop: true
  backchannel_logout: true
  dynamic_client_registration: true
  global_token_revocation: true
  pkce: true
gaps:
- 'No public API reference documents how to obtain credentials, what audience to request, or which scopes gate which operation.'
- 'No API-key or mutualTLS scheme is advertised anywhere public.'
- 'The password and implicit grants remain enabled on the tenant; both are discouraged by OAuth 2.1.'
x-evidence:
  fetched: '2026-08-26'
  url: https://auth.rapiddeploy.com/.well-known/openid-configuration
  http_status: 200
  content_type: application/json