DocumentationMuoCeon Docs
The documentation hub for MuoCeon — guides, references, and release notes for all our projects.
Explore
All pages
- OverviewHow the API docs are organised (overview → version → context → endpoint group), the version list, and the request/response conventions shared across versions.
- account context overviewThe v1 account context (base path /v1/account, audience account) — endpoints and boundaries.
- Account profileGET /v1/account/me and PATCH /v1/account/me — field table, update semantics and constraints.
- Identity assertionPOST /v1/auth/assertion — a 17-second, single-use assertion bound to the session, used by the consent UI.
- AuditGET /v1/auth/audit-logs — what has happened on this account.
- Authenticator appBinding a TOTP authenticator — issuing the secret and checking the first code.
- Email credentialAdd an email, confirm it, resend the code, and promote it to primary.
- Credential management overviewCredential list, provider directory, delete and rename; entry points for each credential type.
- PasskeyRegistering a WebAuthn passkey — issuing the challenge and submitting the attestation.
- Password credentialPUT /v1/auth/credentials/password — first-time setup or change.
- Third-party identityPOST /v1/auth/credentials/provider/:provider — binding a third-party account as a sign-in method.
- Recovery codesPOST /v1/auth/credentials/recovery-codes — generating single-use fallback sign-in codes.
- Session elevationPOST /v1/auth/elevation and /elevation/complete — two-step recent authentication (RFC 9470).
- auth context overviewEndpoint groups, authentication and step-up rules of the v1 auth context (base path /v1/auth, audience auth).
- Management returnPOST /v1/auth/manage/context — validating a first-party application's return address.
- Password resetRequesting a reset link and completing the reset — the two writes that need no session.
- ProfilePATCH /v1/auth/profile, PUT /v1/auth/username and GET /v1/auth/username/available — identity fields.
- Third-party callbackPOST /v1/auth/provider/:provider/callback — exchanging a provider's authorization code for a session token.
- SessionsGET /v1/auth/session, GET /session/list, DELETE /session/others and DELETE /session/:sid — plus cursor pagination.
- Sign-in and registrationPOST /v1/auth/login and POST /v1/auth/register — start parameters, flow token and available verification methods.
- TokensPOST /v1/auth/token, /token/refresh and /token/revoke — the session token pair and "refresh means rotate".
- User infoGET /v1/auth/userinfo — the OIDC UserInfo endpoint, and the only endpoint third-party clients need.
- Verification challengesEmail, password, passkey, authenticator and recovery-code endpoints, plus how a failed challenge is reported.
- v1 overviewv1 overview — the three contexts (auth / oauth / account), base paths and audiences, endpoint group naming, and what may change within v1.
- AuthorizationPOST /v1/oauth/preauthorize and POST /v1/oauth/authorize — the two-step internal endpoints behind the consent page.
- Authorized applicationsGET /v1/oauth/grants and DELETE /v1/oauth/grants/:clientId — the only entry point to authorization relationships.
- oauth context overviewThe endpoint groups of the v1 oauth context (base path /v1/oauth, i.e. the issuer), and how callers are split.
- IntrospectionPOST /v1/oauth/introspect — RFC 7662 token introspection, confidential clients only.
- Public keysGET /v1/oauth/jwks — the JWKS key set, cacheable for 5 minutes.
- RevocationPOST /v1/oauth/revoke — RFC 7009 token revocation with an empty, uncacheable response.
- Token exchangePOST /v1/oauth/token — three grant types, client authentication methods and response fields.
- account context (v2)Placeholder for the v2 account context — v2 is unreleased and defines no endpoints here.
- auth context (v2)Placeholder for the v2 auth context — v2 is unreleased and defines no endpoints here.
- v2 overviewPlaceholder for v2 — unreleased, defining no endpoints yet; when a new version is introduced and how it relates to v1.
- oauth context (v2)Placeholder for the v2 oauth context — v2 is unreleased and defines no endpoints here.
- Account and securityQuestions about the account's own state — passwords and recovery, verification methods, sessions, and the order to follow when someone else has used your account.
- Password and recoveryForgot your password, the reset email never arrived, still cannot sign in after resetting, and password policy questions.
- Sessions and devicesWhere to see signed-in devices, how to revoke one session or all others, whether signing out affects other devices, and why sessions expire.
- Verification methodsWhat passwords, passkeys, authenticators, recovery codes and email each do, why keeping two methods matters, and how recovery codes are consumed.
- Consent page and permissionsWhy the consent page appears, what each permission actually means, what happens if you allow only part of it, and when consent takes effect.
- Authorization and permissionsAuthorization questions between you and an application — what the consent page asks, what happens if you allow only part of it, what revoking does, and why a token cannot read some resource.
- Revoking accessWhere to revoke access, what happens to the application afterwards, why an application keeps asking for authorization, and how revocation differs from signing out.
- FAQ overviewThe FAQ is split into four categories (account and security, sign-in and verification, authorization and permissions, integration and debugging), plus the lookup order by symptom, error code and field.
- Registering a clientHow to obtain a client_id, confidential vs public clients, whether client_secret may live in the frontend, and why the developer platform is not live yet.
- Redirect and code flowRedirect URIs rejected as unregistered, testing callbacks locally, and why implicit flow and the password grant are unsupported.
- Integration and debuggingDeveloper-side FAQ — registering a client, redirect URIs, code exchange, refresh and validation, grouped by integration stage.
- Token exchange and refreshInvestigation order for invalid_grant, why refresh tokens stop working, why scopes go missing, and whether to validate with jwks or introspect.
- Sign-in and verificationQuestions about the sign-in step itself — why you are asked to sign in again, why you are asked to verify once more, and what to do when verification fails.
- Why sign in againReasons you are asked to sign in again or to verify once more, and what to do when verification fails.
- Documentation outlineThe whole of the MuoCeon developer docs — purpose, audience, sections, section guides, reading paths and conventions.
- API reference overviewHow API reference differs from the integration guide, how it is organised by version and context, how to read parameter tables, and what is available today.
- FAQ overviewThe four categories of the FAQ, how to search by symptom and error code, and how it differs from the error code page.
- Integration guide overviewThe four groups inside the integration guide, how the pages depend on each other, the suggested three-stage order, and what the guide does and does not cover.
- Authorization code flowFrom the browser redirect to the authorization code: parameters, what the consent UI does, callback validation.
- Token exchangeRFC 8693 — a first-party admin console swaps a session token for a short-lived token of another audience.
- Exchanging and refreshing tokensThe three grant types at the token endpoint, client authentication, and refresh rotation semantics.
- Discovering metadataGet endpoints, capabilities and scopes from the standard discovery documents instead of hardcoding routes.
- Quick startRun "redirect → consent → callback → token exchange → userinfo" in fifteen minutes.
- Registering a client and redirect URIsWhat to submit, what credentials you receive, and the hard rules for redirect URIs.
- Third-party OAuth integrationSign users in with MuoCeon accounts — from registering a client to holding your first token.
- EndpointsAll external endpoints with authentication, caching constraints and purpose.
- Error codesTwo error response formats, every error code, and a troubleshooting order.
- TokensAccess, refresh and id token structure, claim meanings and validation steps.
- Fine-grained authorizationRFC 9396 — use authorization_details to express "which object, which action".
- Redirect URI policyThe five redirect platforms, address shape rules, matching semantics and the port exception.
- Scopes and audiencesHow permissions are named, which ones you may request, and what the token's aud actually decides.
- Authentication strength and step-upUse acr_values and max_age to require stronger authentication.