generated: '2026-08-06'
method: searched
source: https://auth.allworknow.com/realms/AWN1/.well-known/openid-configuration
note: >-
  Derived from AllWork's own live OpenID Connect discovery document, not from an
  OpenAPI (AllWork publishes none). The realm AWN1 is a Keycloak deployment that
  fronts the AllWork web application (app.allworknow.com) and the brand
  sub-experiences (e.g. beauty.allworknow.com). No public API keys, no
  developer-facing token issuance is documented.
summary:
  types: [openIdConnect, oauth2, mutualTLS]
  api_key_in: []
  oauth2_flows:
    - authorizationCode
    - implicit
    - clientCredentials
    - password
    - refreshToken
    - deviceCode
    - ciba
    - tokenExchange
schemes:
  - name: allworkOIDC
    type: openIdConnect
    openIdConnectUrl: https://auth.allworknow.com/realms/AWN1/.well-known/openid-configuration
    issuer: https://auth.allworknow.com/realms/AWN1
    sources: [well-known/allwork-openid-configuration.json]
  - name: allworkOAuth2
    type: oauth2
    sources: [well-known/allwork-openid-configuration.json]
    endpoints:
      authorization: https://auth.allworknow.com/realms/AWN1/protocol/openid-connect/auth
      token: https://auth.allworknow.com/realms/AWN1/protocol/openid-connect/token
      userinfo: https://auth.allworknow.com/realms/AWN1/protocol/openid-connect/userinfo
      jwks: https://auth.allworknow.com/realms/AWN1/protocol/openid-connect/certs
      end_session: https://auth.allworknow.com/realms/AWN1/protocol/openid-connect/logout
      introspection: https://auth.allworknow.com/realms/AWN1/protocol/openid-connect/token/introspect
      revocation: https://auth.allworknow.com/realms/AWN1/protocol/openid-connect/revoke
      device_authorization: https://auth.allworknow.com/realms/AWN1/protocol/openid-connect/auth/device
      backchannel_authentication: https://auth.allworknow.com/realms/AWN1/protocol/openid-connect/ext/ciba/auth
      pushed_authorization_request: https://auth.allworknow.com/realms/AWN1/protocol/openid-connect/ext/par/request
      dynamic_client_registration: https://auth.allworknow.com/realms/AWN1/clients-registrations/openid-connect
    grant_types_supported:
      - authorization_code
      - implicit
      - refresh_token
      - password
      - client_credentials
      - urn:ietf:params:oauth:grant-type:device_code
      - urn:openid:params:grant-type:ciba
      - urn:ietf:params:oauth:grant-type:token-exchange
    response_types_supported:
      - code
      - none
      - id_token
      - token
      - id_token token
      - code id_token
      - code token
      - code id_token token
    response_modes_supported:
      - query
      - fragment
      - form_post
      - query.jwt
      - fragment.jwt
      - form_post.jwt
      - jwt
    token_endpoint_auth_methods_supported:
      - private_key_jwt
      - client_secret_basic
      - client_secret_post
      - tls_client_auth
      - client_secret_jwt
    code_challenge_methods_supported: [plain, S256]
    id_token_signing_alg_values_supported:
      [PS384, ES384, RS384, HS256, HS512, ES256, RS256, HS384, ES512, PS256, PS512, RS512]
    subject_types_supported: [public, pairwise]
    claims_supported:
      [aud, sub, iss, auth_time, name, given_name, family_name, preferred_username, email, acr]
    acr_values_supported: ['0', '1']
    request_parameter_supported: true
    require_pushed_authorization_requests: false
  - name: allworkMutualTLS
    type: mutualTLS
    sources: [well-known/allwork-openid-configuration.json]
    note: >-
      tls_client_certificate_bound_access_tokens is true and mtls_endpoint_aliases
      are advertised; tls_client_auth is an accepted client authentication method.
observed_in_the_wild:
  - client_id: AWN1
    flow: authorization_code with PKCE (S256)
    redirect_uri: https://beauty.allworknow.com/
    scope: openid
    source: >-
      login link rendered in the public HTML of https://allworknow.com/
gaps:
  - No public documentation of this authorization server exists on allworknow.com.
  - No developer key issuance, no API reference, and no documented consumer-facing token flow.
x-evidence:
  fetched: '2026-08-06'
  url: https://auth.allworknow.com/realms/AWN1/.well-known/openid-configuration
  http_status: 200
  content_type: application/json