generated: '2026-09-06'
method: searched
source: https://www.drillster.com/info/developers/rest-apis/oauth/
docs: https://www.drillster.com/info/developers/rest-apis/oauth/
discovery: well-known/drillster-oauth-authorization-server.json
note: >-
  Drillster publishes no OpenAPI, so this profile is read from the OAuth 2.0 documentation
  and from the provider's own RFC 8414 authorization-server metadata document, fetched live
  at https://www.drillster.com/.well-known/oauth-authorization-server.
summary:
  types: [oauth2]
  api_key_in: []
  oauth2_flows: [authorizationCode, jwt-bearer, refreshToken]
  bearer_token_header: "Authorization: Bearer {access_token}"
  public_clients_supported: false
schemes:
  - name: OAuth2
    type: oauth2
    source: https://www.drillster.com/.well-known/oauth-authorization-server
    issuer: https://www.drillster.com
    flows:
      - flow: authorizationCode
        authorizationUrl: https://www.drillster.com/daas/oauth/authorize
        tokenUrl: https://www.drillster.com/daas/oauth/token
        refresh: true
        docs: https://www.drillster.com/info/developers/rest-apis/oauth/authorization-code-grant/
        note: >-
          Used for end-user scenarios (embedding a widget on behalf of a logged-in user).
          Refresh tokens ARE issued for this grant; the authorization code is valid for one hour.
      - flow: 'urn:ietf:params:oauth:grant-type:jwt-bearer'
        tokenUrl: https://www.drillster.com/daas/oauth/token
        docs: https://www.drillster.com/info/developers/rest-apis/oauth/jwt-authorization-grant/
        spec: RFC 7523 section 2.1 (JWT Profile for OAuth 2.0 Client Authentication and Authorization Grants)
        note: >-
          The primary server-to-server grant. Requires a service account with an RSA key pair
          generated by the Drillster platform; Drillster retains only the public key. The client
          signs a JWT assertion and POSTs it with
          grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer&assertion=<signed JWT>.
          No refresh tokens are issued for this grant — the client re-mints an assertion.
    jwks_uri: https://www.drillster.com/daas/oauth/keys
    revocation_endpoint: https://www.drillster.com/daas/oauth/revoke
    revocation_endpoint_auth_methods_supported: [none]
    token_mediating_backend_endpoint: https://www.drillster.com/tmb/token
client_registration:
  docs: https://www.drillster.com/info/developers/rest-apis/registering-your-application/
  model: manual — register the application in the Drillster developer console to receive a client ID
  client_id_form: 32-character hex string, not secret
  client_secret: >-
    Generated in the console and displayed once; Drillster does not store the secret itself.
    Multiple concurrent secrets are supported and each may be revoked independently. Revoking
    a secret does not invalidate access tokens already issued from it.
  confidential_clients_only: true
  note: >-
    Public clients (native apps, browser JavaScript) cannot use the Drillster REST APIs —
    only confidential, server-side clients.
service_accounts:
  docs: https://www.drillster.com/info/developers/rest-apis/service-accounts/
  description: >-
    Non-human administrative accounts scoped to an organization, used for server-to-server API
    calls. Cannot be logged into interactively. Permissions and group access are assigned the
    same way as for a human administrator, so least-privilege is configurable per integration.
  key_material: RSA key pair generated by Drillster; private key issued once to the administrator
token:
  type: JWT bearer
  transport: "Authorization: Bearer <token> header, HTTPS only (plain HTTP is refused)"
  lifetime: >-
    Documented as varying, typically one to several hours; expires_in is returned with the token.
  refresh_tokens: issued for the authorization-code grant only
sso:
  - standard: OpenID Connect
    role: Drillster acts as the RELYING PARTY against a customer-operated OIDC server
    docs: https://www.drillster.com/info/developers/integration-types/open-id-connect/
  - standard: LTI 1.0 / LTI 1.3
    role: Drillster acts as the LTI tool; LTI 1.3 uses the customer's OIDC configuration
    docs: https://www.drillster.com/info/developers/integration-types/lti/