generated: '2026-07-17'
method: searched
source: https://sso.alien-api.com/.well-known/openid-configuration
docs: https://docs.alien.org/sso-guide/oauth2-clients
standards:
- id: oauth2
  conforms: true
  evidence: authorization_endpoint/token_endpoint + grant_types authorization_code & refresh_token advertised in discovery
- id: oidc
  conforms: true
  evidence: /.well-known/openid-configuration present; id_token RS256; claims sub/iss/aud/exp/iat/nonce/auth_time/cnf
- id: rfc8414-oauth-authorization-server-metadata
  conforms: true
  evidence: /.well-known/oauth-authorization-server returns 200 with server metadata
- id: rfc7636-pkce
  conforms: true
  evidence: code_challenge_methods_supported [S256]
- id: rfc9449-dpop
  conforms: true
  evidence: dpop_signing_alg_values_supported [EdDSA]; cnf claim supported
- id: rfc8628-device-authorization
  conforms: false
  evidence: no device_authorization_endpoint in discovery; uses deep-link + poll instead
- id: rfc9457-problem-details
  conforms: false
  evidence: errors use OAuth 2.0 error format (error/error_description), not application/problem+json
notes: >-
  Standards conformance derived from the live OIDC/OAuth discovery documents and
  the published SSO API reference. No third-party security-compliance program
  (SOC 2 / ISO 27001 / PCI / HIPAA / FedRAMP) is published, so no Compliance
  pointer is emitted.