Discovery

Machine-readable metadata. Start here: a compliant client needs nothing else than the issuer URL https://auth.nucleoplatform.com.

Base URL, authentication and conventions of this API are on the OAuth & OpenID Connect API page.

Endpoints

get/.well-known/openid-configurationGet OpenID Connect discovery document
get/.well-known/oauth-authorization-serverGet OAuth authorization server metadata
get/.well-known/jwks.jsonGet the token signing keys

get/.well-known/openid-configuration

Get OpenID Connect discovery document

OpenID Connect Discovery 1.0 document. Public, cacheable, served with Access-Control-Allow-Origin: * so browser-based clients can read it.

Notes on the current implementation:

response_types_supported is only code; implicit and hybrid flows are not available.
grant_types_supported is authorization_code and refresh_token: there is no client_credentials grant.
code_challenge_methods_supported is only S256.
ID tokens are signed with RS256 and returned by the code exchange when the scope includes openid; claims_supported lists every claim they can carry. The request, request_uri and claims authorization parameters are not supported.
For everything beyond the ID token claims (companies, module access) call userinfo with the access token.

GET https://auth.nucleoplatform.com/.well-known/openid-configuration

Authentication: None — public endpoint

Responses

200Discovery document.application/json
Headers
- Access-Control-Allow-Origin
- issuerstring (uri)
- authorization_endpointstring (uri)
- token_endpointstring (uri)
- userinfo_endpointstring (uri)
- jwks_uristring (uri)
- registration_endpointstring (uri)
- scopes_supportedarray of string
- response_types_supportedarray of string
- grant_types_supportedarray of string
- code_challenge_methods_supportedarray of string
- token_endpoint_auth_methods_supportedarray of string
- response_modes_supportedarray of string
- service_documentationstring (uri)
- subject_types_supportedarray of string
- id_token_signing_alg_values_supportedarray of string
  One ofRS256
- claims_supportedarray of string
- request_parameter_supportedboolean
  One offalse
- request_uri_parameter_supportedboolean
  One offalse
- claims_parameter_supportedboolean
  One offalse

Request

curl -X GET https://auth.nucleoplatform.com/.well-known/openid-configuration \
  -H 'Accept: application/json'

const res = await fetch("https://auth.nucleoplatform.com/.well-known/openid-configuration", {
  method: "GET",
  headers: {
    Accept: "application/json",
  },
});
const data = await res.json();
console.log(res.status, data);

<?php

require 'vendor/autoload.php';

$client = new GuzzleHttp\Client();

$response = $client->request('GET', 'https://auth.nucleoplatform.com/.well-known/openid-configuration', [
    'headers' => [
        'Accept' => 'application/json',
    ],
    'http_errors' => false,
]);

echo $response->getStatusCode(), PHP_EOL;
echo $response->getBody();

Response

{
  "issuer": "https://auth.nucleoplatform.com",
  "authorization_endpoint": "https://auth.nucleoplatform.com/oauth/authorize",
  "token_endpoint": "https://auth.nucleoplatform.com/oauth/token",
  "userinfo_endpoint": "https://auth.nucleoplatform.com/api/oauth/userinfo",
  "jwks_uri": "https://auth.nucleoplatform.com/.well-known/jwks.json",
  "registration_endpoint": "https://auth.nucleoplatform.com/oauth/register",
  "scopes_supported": [
    "openid",
    "profile",
    "email",
    "offline_access",
    "nucleo.ai_tools"
  ],
  "response_types_supported": [
    "code"
  ],
  "response_modes_supported": [
    "query"
  ],
  "grant_types_supported": [
    "authorization_code",
    "refresh_token"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_post",
    "client_secret_basic",
    "none"
  ],
  "service_documentation": "https://nucleoplatform.com/developers",
  "subject_types_supported": [
    "public"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "claims_supported": [
    "iss",
    "sub",
    "aud",
    "azp",
    "exp",
    "iat",
    "jti",
    "auth_time",
    "nonce",
    "email",
    "email_verified",
    "name",
    "picture",
    "locale"
  ],
  "request_parameter_supported": false,
  "request_uri_parameter_supported": false,
  "claims_parameter_supported": false
}

get/.well-known/oauth-authorization-server

Get OAuth authorization server metadata

OAuth 2.0 Authorization Server Metadata (RFC 8414). This is the document MCP clients reach after reading the protected-resource metadata of the Nucleo MCP server (https://mcp.nucleoplatform.com/.well-known/oauth-protected-resource); from here they take registration_endpoint to register themselves. Public, with Access-Control-Allow-Origin: *.

GET https://auth.nucleoplatform.com/.well-known/oauth-authorization-server

Authentication: None — public endpoint

Responses

200Authorization server metadata.application/json
Headers
- Access-Control-Allow-Origin
- issuerstring (uri)
- authorization_endpointstring (uri)
- token_endpointstring (uri)
- registration_endpointstring (uri)
- jwks_uristring (uri)
- userinfo_endpointstring (uri)
- scopes_supportedarray of string
- response_types_supportedarray of string
- response_modes_supportedarray of string
- grant_types_supportedarray of string
- code_challenge_methods_supportedarray of string
- token_endpoint_auth_methods_supportedarray of string
- service_documentationstring (uri)

Request

curl -X GET https://auth.nucleoplatform.com/.well-known/oauth-authorization-server \
  -H 'Accept: application/json'

const res = await fetch("https://auth.nucleoplatform.com/.well-known/oauth-authorization-server", {
  method: "GET",
  headers: {
    Accept: "application/json",
  },
});
const data = await res.json();
console.log(res.status, data);

<?php

require 'vendor/autoload.php';

$client = new GuzzleHttp\Client();

$response = $client->request('GET', 'https://auth.nucleoplatform.com/.well-known/oauth-authorization-server', [
    'headers' => [
        'Accept' => 'application/json',
    ],
    'http_errors' => false,
]);

echo $response->getStatusCode(), PHP_EOL;
echo $response->getBody();

Response

{
  "issuer": "https://auth.nucleoplatform.com",
  "authorization_endpoint": "https://auth.nucleoplatform.com/oauth/authorize",
  "token_endpoint": "https://auth.nucleoplatform.com/oauth/token",
  "registration_endpoint": "https://auth.nucleoplatform.com/oauth/register",
  "jwks_uri": "https://auth.nucleoplatform.com/.well-known/jwks.json",
  "userinfo_endpoint": "https://auth.nucleoplatform.com/api/oauth/userinfo",
  "scopes_supported": [
    "openid",
    "profile",
    "email",
    "offline_access",
    "nucleo.ai_tools"
  ],
  "response_types_supported": [
    "code"
  ],
  "response_modes_supported": [
    "query"
  ],
  "grant_types_supported": [
    "authorization_code",
    "refresh_token"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_post",
    "client_secret_basic",
    "none"
  ],
  "service_documentation": "https://nucleoplatform.com/developers"
}

get/.well-known/jwks.json

Get the token signing keys

JSON Web Key Set with the RSA public key that signs Nucleo access tokens and ID tokens (RS256). The kid is the base64url SHA-256 of the public key, so it changes only when the key is rotated; ID tokens carry it in their header. Use it to verify a token locally (signature, exp, aud = your client_id). Public, with Access-Control-Allow-Origin: *. Returns {"keys": []} only if the server has no key configured.

GET https://auth.nucleoplatform.com/.well-known/jwks.json

Authentication: None — public endpoint

Responses

200Key set.application/json
- keysarray of objectrequired
  Attributes of each item
  ktystring
  One ofRSA
  usestring
  One ofsig
  algstring
  One ofRS256
  kidstring
  nstring
  Modulus
  
  estring
  Exponent

Request

curl -X GET https://auth.nucleoplatform.com/.well-known/jwks.json \
  -H 'Accept: application/json'

const res = await fetch("https://auth.nucleoplatform.com/.well-known/jwks.json", {
  method: "GET",
  headers: {
    Accept: "application/json",
  },
});
const data = await res.json();
console.log(res.status, data);

<?php

require 'vendor/autoload.php';

$client = new GuzzleHttp\Client();

$response = $client->request('GET', 'https://auth.nucleoplatform.com/.well-known/jwks.json', [
    'headers' => [
        'Accept' => 'application/json',
    ],
    'http_errors' => false,
]);

echo $response->getStatusCode(), PHP_EOL;
echo $response->getBody();

Response

{
  "keys": [
    {
      "kty": "RSA",
      "use": "sig",
      "alg": "RS256",
      "kid": "3rL1x0dXq6m0yBqH2l7xZr9n0bq8f4k1s2vJt8o5pWc",
      "n": "0vx7agoebGcQSuuPiLJXZptN9nndrQmbXEps2aiAFbWhM78LhWx4cbbfAAtVT86zwu1RK7aPFFxuhDR1L6tSoc_BJECPebWKRXjBZCiFV4n3oknjhMstn64tZ_2W-5JsGY4Hc5n9yBXArwl93lqt7_RN5w6Cf0h4QyQ5v-65YGjQR0_FDW2QvzqY368QQMicAtaSqzs8KJZgnYb9c7d0zgdAZHzu6qMQvRL5hajrn1n91CbOpbISD08qNLyrdkt-bFTWhAI4vMQFh6WeZu0fM4lFd2NcRwr3XPksINHaQ-G_xBniIqbw0Ls1jF44-csFCur-kEgU8awapJzKnqDKgw",
      "e": "AQAB"
    }
  ]
}

Was this page helpful?