# OAuth Surface

> Check a platform's OAuth authorization server so a compromised app or a leaked token stays contained. Describe the
> server or paste its discovery document; the browser flags implicit and password grants, checks PKCE S256 for every
> client, exact redirect matching and every registered redirect URI, code, access and refresh token lifetimes, refresh
> rotation with reuse detection and its grace window, lints every scope and its consent sentence, puts each scope in a
> review tier, and ranks the refresh, scope-granularity and registration choices from a short interview. Metered runs
> write the provider core, and the registration and verification program. Built on the SkillSafe skill
> @samber/oauth2-provider-design, from samber/developer-platform-skills (MIT), by Samuel Berthe.

https://oauth-surface.skillsafe.ai/

## What is free
- Protocol core: no implicit or password grant (an RFC 8414 discovery document without grant_types_supported defaults to both authorization_code and implicit), authorization_code, refresh_token, client_credentials for app-identity tokens, device authorization for CLIs, PKCE S256 for every client and no plain method, exact redirect matching, registered redirect URIs without wildcards, fragments or plain http off loopback, no bearer tokens in query strings.
- A redirect tester: a requested URI checked against the registered list by exact match, with the loopback port the only exception - and a note when a prefix matcher would have let it through.
- Tokens: single-use codes of at most 10 minutes, access tokens of about an hour, refresh tokens rotated or sender-constrained for public clients, reuse detection, a 10-30 second grace window, browser refresh tokens of at most 24 hours.
- Scopes and consent: resource:action names, no catch-all scope, read and write split, one plain-language consent sentence per scope, scopes bound to a token type when apps also act as themselves, partial grants with a server-side diff, incremental consent showing only the new scope, an admin consent surface where org admins gate installs, and a preview of the consent screen.
- Registration and verification: no open dynamic registration, publisher identity verification, a third-party assessment for every scope that reaches other users' data, a capped testing lane, a runtime subset check, distinct trust badges.
- The rankings: refresh posture (rotation, DPoP, non-rotating for confidential clients only), scope granularity (resource:action or fine-grained), registration (reviewed portal or gated dynamic).
- A discovery document for the ranked design, a PKCE pair from the browser's random source and SHA-256, and exports: the checks (.csv), the open checks as a Markdown checklist, everything (.json).
- A saved provider re-opened after a fix shows which checks were fixed and which are new or worse.

A design-review aid, not a security guarantee: the checks grade the provider as described, not the server itself - prove each one against the live endpoints.

## The metered lanes
Two tasks on gpt-terra, metered per run, routed by `task`. Input string fields: `task` (core or program), `provider`, `surface`, `carry` (program only: the core's decisions) and `facts`.
- `core` replies with `summary`, `grants`, `pkce`, `redirects`, `tokens`, `refresh`, `granularity`, `scopes` (each with its consent sentence, token type, access and review tier), `consent` and `caveats`.
- `program` replies with `summary`, `registration`, `tiers`, `testing`, `enforcement`, `badges`, `gates`, `metrics`, `rollout` and `caveats`.
The page holds every reply to its own facts: the ranked rungs, implicit and password removed, PKCE S256 for all clients, exact redirects, short single-use codes, every listed scope covered with its own sentence and other users' data kept in the assessment tier; a testing lane of at most 100 users and 7-day test tokens, a runtime subset check, and gates in all four areas.

## Links
- API tutorial: https://oauth-surface.skillsafe.ai/api.html
- Source skill: https://skillsafe.ai/skill/@samber/oauth2-provider-design