generated: '2026-08-13'
method: probed
source: https://auth.1mind.com/.well-known/openid-configuration (HTTP 200) +
  https://auth.1mind.com/.well-known/oauth-authorization-server (HTTP 200) +
  observed WWW-Authenticate challenge on https://auth.1mind.com/userinfo (HTTP 401)
name: 1mind Authentication
summary: >-
  1mind runs a full OAuth 2.0 / OpenID Connect authorization server at
  https://auth.1mind.com. It is an Ory-hosted deployment (the host resolves to
  distracted-wright-ks3ftfdysg.projects.oryapis.com, and Ory is named as the
  identity-provider subprocessor on 1mind's own sub-processor page), operated
  under 1mind's own domain and its own issuer identifier. The discovery document
  is anonymous and machine-readable; the resource APIs it protects are not
  publicly documented, so the operations a token grants are not enumerable from
  public sources.
issuer: https://auth.1mind.com
discovery:
  openid_configuration: https://auth.1mind.com/.well-known/openid-configuration
  oauth_authorization_server: https://auth.1mind.com/.well-known/oauth-authorization-server
  note: Both endpoints return the same document (1987 bytes, identical).
security_schemes:
- key: oauth2
  type: oauth2
  description: OAuth 2.0 authorization server with PKCE, refresh tokens and the
    device authorization grant.
  flows:
    authorizationCode:
      authorizationUrl: https://auth.1mind.com/oauth2/auth
      tokenUrl: https://auth.1mind.com/oauth2/token
      refreshUrl: https://auth.1mind.com/oauth2/token
      pkce: true
      code_challenge_methods:
      - S256
      - plain
    clientCredentials:
      tokenUrl: https://auth.1mind.com/oauth2/token
    deviceCode:
      deviceAuthorizationUrl: https://auth.1mind.com/oauth2/device/auth
      tokenUrl: https://auth.1mind.com/oauth2/token
    implicit:
      authorizationUrl: https://auth.1mind.com/oauth2/auth
      note: Advertised in response_types_supported; legacy, not recommended.
- key: openIdConnect
  type: openIdConnect
  openIdConnectUrl: https://auth.1mind.com/.well-known/openid-configuration
  description: OpenID Connect 1.0 with RS256-signed ID tokens.
- key: bearer
  type: http
  scheme: bearer
  bearerFormat: JWT
  description: >-
    Protected endpoints answer HTTP 401 with an RFC 6750 challenge, observed
    verbatim on https://auth.1mind.com/userinfo:
    WWW-Authenticate: Bearer error="request_unauthorized",
    error_description="The request could not be authorized. Check that you
    provided valid credentials in the right format."
endpoints:
  authorization: https://auth.1mind.com/oauth2/auth
  token: https://auth.1mind.com/oauth2/token
  device_authorization: https://auth.1mind.com/oauth2/device/auth
  revocation: https://auth.1mind.com/oauth2/revoke
  userinfo: https://auth.1mind.com/userinfo
  jwks: https://auth.1mind.com/.well-known/jwks.json
  end_session: https://auth.1mind.com/oauth2/sessions/logout
  credentials_draft_00: https://auth.1mind.com/credentials
grant_types_supported:
- authorization_code
- implicit
- client_credentials
- refresh_token
- urn:ietf:params:oauth:grant-type:device_code
response_types_supported:
- code
- code id_token
- id_token
- token id_token
- token
- token id_token code
response_modes_supported:
- query
- fragment
- form_post
token_endpoint_auth_methods_supported:
- client_secret_post
- client_secret_basic
- private_key_jwt
- none
signing:
  id_token_signing_alg_values_supported:
  - RS256
  userinfo_signing_alg_values_supported:
  - none
  - RS256
  request_object_signing_alg_values_supported:
  - none
  - RS256
  - ES256
scopes_supported:
- openid
- offline
- offline_access
scopes_reference: ../scopes/1mind-scopes.yml
features:
  pkce: true
  refresh_tokens: true
  device_flow: true
  private_key_jwt: true
  request_object: true
  request_uri: true
  require_request_uri_registration: true
  claims_parameter_supported: false
  backchannel_logout: true
  frontchannel_logout: true
  verifiable_credentials_draft: true
claims_supported:
- sub
api_key_auth:
  documented: false
  note: >-
    1mind's public status page lists a component "US Region - REST API"
    described as "Public 1mind API", but no public API reference, key-issuance
    page or authentication guide could be located (see x-coverage in apis.yml).
    Whether that API accepts OAuth 2.0 bearer tokens from this authorization
    server, a separate API key, or both, is not stated anywhere public.
docs: null
docs_note: >-
  No public authentication documentation exists. developer.1mind.com and
  docs.1mind.com are NOT developer portals — they are the *.1mind.com wildcard
  SPA (see well-known/1mind-well-known.yml). The 1mindai/docs GitHub repository
  is an unmodified Mintlify starter kit.