generated: '2026-08-04'
method: searched
source: https://auth.gymshark.com/.well-known/openid-configuration
docs: null
note: >-
  Gymshark publishes no OpenAPI and no developer authentication documentation, so this
  profile is read directly from the OpenID Connect Discovery / RFC 8414 metadata that
  Gymshark's own authorization server publishes anonymously at auth.gymshark.com. It
  describes how Gymshark customer accounts authenticate across the storefronts and the
  Gymshark Shop / Gymshark Training mobile apps. It is not a self-serve developer API —
  there is no published client-registration or partner onboarding path.
summary:
  types:
  - openIdConnect
  - oauth2
  oauth2_flows:
  - authorizationCode
  - clientCredentials
  - implicit
  - deviceCode
  - refreshToken
  - password
  - tokenExchange
  pkce: true
  pkce_methods:
  - S256
  - plain
  dpop: true
  mfa: true
  dynamic_client_registration: true
schemes:
- name: gymshark-oidc
  type: openIdConnect
  openIdConnectUrl: https://auth.gymshark.com/.well-known/openid-configuration
  issuer: https://auth.gymshark.com/
  vendor: Auth0
  sources:
  - well-known/gymshark-openid-configuration.json
- name: gymshark-oauth2
  type: oauth2
  issuer: https://auth.gymshark.com/
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth.gymshark.com/authorize
    tokenUrl: https://auth.gymshark.com/oauth/token
  - flow: clientCredentials
    tokenUrl: https://auth.gymshark.com/oauth/token
  - flow: implicit
    authorizationUrl: https://auth.gymshark.com/authorize
  - flow: deviceCode
    deviceAuthorizationUrl: https://auth.gymshark.com/oauth/device/code
    tokenUrl: https://auth.gymshark.com/oauth/token
  sources:
  - well-known/gymshark-oauth-authorization-server.json
endpoints:
  issuer: https://auth.gymshark.com/
  authorization: https://auth.gymshark.com/authorize
  token: https://auth.gymshark.com/oauth/token
  userinfo: https://auth.gymshark.com/userinfo
  jwks: https://auth.gymshark.com/.well-known/jwks.json
  registration: https://auth.gymshark.com/oidc/register
  revocation: https://auth.gymshark.com/oauth/revoke
  device_authorization: https://auth.gymshark.com/oauth/device/code
  backchannel_authentication: https://auth.gymshark.com/bc-authorize
  mfa_challenge: https://auth.gymshark.com/mfa/challenge
  global_token_revocation: https://auth.gymshark.com/oauth/global-token-revocation/connection/{connectionName}
grant_types_supported:
- client_credentials
- authorization_code
- refresh_token
- password
- implicit
- urn:ietf:params:oauth:grant-type:device_code
- urn:ietf:params:oauth:grant-type:token-exchange
- http://auth0.com/oauth/grant-type/password-realm
- http://auth0.com/oauth/grant-type/passwordless/otp
- http://auth0.com/oauth/grant-type/mfa-oob
- http://auth0.com/oauth/grant-type/mfa-otp
- http://auth0.com/oauth/grant-type/mfa-recovery-code
response_types_supported:
- code
- token
- id_token
- code token
- code id_token
- token id_token
- code token id_token
response_modes_supported:
- query
- fragment
- form_post
token_endpoint_auth_methods_supported:
- client_secret_basic
- client_secret_post
- private_key_jwt
- none
token_endpoint_auth_signing_alg_values_supported:
- RS256
- RS384
- PS256
id_token_signing_alg_values_supported:
- HS256
- RS256
- PS256
dpop_signing_alg_values_supported:
- ES256
subject_types_supported:
- public
claims_supported:
- aud
- auth_time
- created_at
- email
- email_verified
- exp
- family_name
- given_name
- iat
- identities
- iss
- name
- nickname
- phone_number
- picture
- sub
session_management:
  backchannel_logout_supported: true
  backchannel_logout_session_supported: true
  backchannel_token_delivery_modes_supported:
  - poll
request_object_support:
  request_parameter_supported: false
  request_uri_parameter_supported: false
observations:
- >-
  The legacy `password` (resource owner password credentials) and `implicit` grants
  are still advertised alongside authorization_code + PKCE; both are discouraged by
  OAuth 2.1 and the OAuth 2.0 Security BCP (RFC 9700).
- >-
  `code_challenge_methods_supported` still lists `plain` in addition to `S256`; `S256`
  is the only method OAuth 2.1 permits.
- >-
  `id_token_signing_alg_values_supported` still lists the symmetric `HS256` alongside
  `RS256`/`PS256`.
- >-
  DPoP (RFC 9449) sender-constrained tokens are supported (ES256), as is RFC 8693
  token exchange and RFC 7591 dynamic client registration.
x-evidence:
  fetched: '2026-08-04'
  url: https://auth.gymshark.com/.well-known/openid-configuration
  http_status: 200
  content_type: application/json