generated: '2026-08-11'
method: probed
source: https://auth.darrow.ai/.well-known/openid-configuration
docs: null
note: >-
  Darrow publishes no public API reference, so this profile is derived entirely from the
  OpenID Connect discovery document its Auth0 tenant serves anonymously. It describes how
  the Darrow customer portal authenticates users — it is NOT a published developer
  authentication scheme, and no API key, client-credential issuance flow or token
  documentation is available to the public.
issuer: https://auth.darrow.ai/
provider: Auth0 (tenant also reachable at https://darrow.us.auth0.com/)
schemes:
- id: openIdConnect
  type: openIdConnect
  openIdConnectUrl: https://auth.darrow.ai/.well-known/openid-configuration
  description: OpenID Connect discovery for the Darrow customer portal.
- id: oauth2_authorization_code
  type: oauth2
  flow: authorizationCode
  authorizationUrl: https://auth.darrow.ai/authorize
  tokenUrl: https://auth.darrow.ai/oauth/token
  refreshUrl: https://auth.darrow.ai/oauth/token
  pkce: true
  pkce_methods:
  - S256
  - plain
  description: Interactive login for portal.darrow.ai / platform.darrow.ai.
- id: oauth2_client_credentials
  type: oauth2
  flow: clientCredentials
  tokenUrl: https://auth.darrow.ai/oauth/token
  description: >-
    Advertised by the tenant's grant_types_supported. Machine-to-machine credentials
    are not offered publicly; issuance would be a tenant/contract matter.
- id: oauth2_device_code
  type: oauth2
  flow: deviceCode
  deviceAuthorizationUrl: https://auth.darrow.ai/oauth/device/code
  tokenUrl: https://auth.darrow.ai/oauth/token
endpoints:
  authorization: https://auth.darrow.ai/authorize
  token: https://auth.darrow.ai/oauth/token
  userinfo: https://auth.darrow.ai/userinfo
  jwks: https://auth.darrow.ai/.well-known/jwks.json
  revocation: https://auth.darrow.ai/oauth/revoke
  registration: https://auth.darrow.ai/oidc/register
  device_authorization: https://auth.darrow.ai/oauth/device/code
  backchannel_authentication: https://auth.darrow.ai/bc-authorize
  mfa_challenge: https://auth.darrow.ai/mfa/challenge
  global_token_revocation: https://auth.darrow.ai/oauth/global-token-revocation/connection/{connectionName}
grant_types_supported:
- client_credentials
- authorization_code
- refresh_token
- password
- implicit
- urn:ietf:params:oauth:grant-type:device_code
- urn:ietf:params:oauth:grant-type:token-exchange
- urn:ietf:params:oauth:grant-type:jwt-bearer
- http://auth0.com/oauth/grant-type/password-realm
- http://auth0.com/oauth/grant-type/passwordless/otp
- http://auth0.com/oauth/grant-type/mfa-oob
- http://auth0.com/oauth/grant-type/mfa-otp
- http://auth0.com/oauth/grant-type/mfa-recovery-code
token_endpoint_auth_methods_supported:
- client_secret_basic
- client_secret_post
- private_key_jwt
- none
id_token_signing_alg_values_supported:
- HS256
- RS256
- PS256
features:
  pkce: true
  dpop: true
  dpop_signing_alg_values_supported:
  - ES256
  dynamic_client_registration: true
  mfa: true
  ciba_backchannel: true
  token_exchange: true
  request_parameter_supported: false
  request_uri_parameter_supported: false
observations:
- The tenant still advertises the legacy `password` and `implicit` grants alongside
  authorization_code + PKCE; both are discouraged by OAuth 2.1.
- HS256 remains in id_token_signing_alg_values_supported, so a symmetric-signed ID token
  is possible for clients configured that way.
- No /.well-known/oauth-protected-resource document is served (404), so there is no
  published resource-server metadata binding an API audience to this issuer.
x-evidence:
  fetched: '2026-08-11'
  url: https://auth.darrow.ai/.well-known/openid-configuration
  http_status: 200
  content_type: application/json