generated: '2026-07-18'
method: derived
source: authentication/bitstrips-authentication.yml, https://github.com/Bitmoji/BitmojiForDevelopers/blob/main/docs/DIRECT_AUTH_FOR_DEVELOPERS.md
standards:
- id: oauth2
  conforms: true
  evidence: Bitmoji Direct authorization uses an OAuth2 authorization-code flow (token + revocation endpoints documented)
- id: oauth2-pkce
  conforms: true
  evidence: PKCE with S256 code_challenge_method is required on the authorization request
- id: oidc
  conforms: false
  evidence: no OpenID Connect discovery or id_token documented
- id: rfc9457-problem-details
  conforms: false
  evidence: no application/problem+json error format documented
notes: >-
  Derived from the published Bitmoji Direct developer docs; no formal compliance
  program (SOC 2 / ISO 27001 / etc.) is published for this developer surface, so
  no Compliance pointer is emitted.