generated: '2026-09-14'
method: probed
source: https://login.hrblock.com/.well-known/openid-configuration
provider: H&R Block
providerId: hanr-block
description: >-
  H&R Block runs a first-party PingFederate OAuth 2.0 / OpenID Connect authorization
  server at https://login.hrblock.com and publishes its full discovery metadata
  anonymously. This profile is read directly from that document plus a live fetch of the
  advertised JWKS. No OpenAPI exists for the record, so nothing here is derived from a
  spec — every value below came off the wire on 2026-09-14.
ownership: >-
  The issuer is https://login.hrblock.com, a hrblock.com host, and the custom scopes it
  advertises (hrbGuaid, hrbUcid) are H&R Block internal identifiers. First-party.
issuer: https://login.hrblock.com
product: PingFederate (Ping Identity)
schemes:
  - id: hrblock_oauth2
    type: oauth2
    name: H&R Block OAuth 2.0 / OpenID Connect
    description: >-
      Authorization server fronting MyBlock and the H&R Block digital properties.
      Registration, token, introspection and revocation endpoints are all advertised.
    endpoints:
      authorization: https://login.hrblock.com/as/authorization.oauth2
      token: https://login.hrblock.com/as/token.oauth2
      userinfo: https://login.hrblock.com/idp/userinfo.openid
      jwks_uri: https://login.hrblock.com/pf/JWKS
      registration: https://login.hrblock.com/as/clients.oauth2
      introspection: https://login.hrblock.com/as/introspect.oauth2
      revocation: https://login.hrblock.com/as/revoke_token.oauth2
      device_authorization: https://login.hrblock.com/as/device_authz.oauth2
      pushed_authorization_request: https://login.hrblock.com/as/par.oauth2
      backchannel_authentication: https://login.hrblock.com/as/bc-auth.ciba
    flows:
      - authorization_code
      - implicit
      - refresh_token
      - password
      - client_credentials
      - device_code
      - token_exchange
      - jwt_bearer
      - saml2_bearer
      - ciba
    client_authentication:
      - client_secret_basic
      - client_secret_post
      - client_secret_jwt
      - private_key_jwt
      - tls_client_auth
      - none
    pkce:
      supported: true
      methods:
        - S256
        - plain
    response_types:
      - code
      - token
      - id_token
      - code token
      - code id_token
      - token id_token
      - code token id_token
    subject_types:
      - public
      - pairwise
    id_token_signing_algs:
      - RS256
      - RS384
      - RS512
      - ES256
      - ES384
      - ES512
      - PS256
      - PS384
      - PS512
      - HS256
      - HS384
      - HS512
      - none
    claims_supported:
      - sub
      - entryUUID
      - givenName
      - mail
      - sn
    require_pushed_authorization_requests: false
jwks:
  url: https://login.hrblock.com/pf/JWKS
  status: 200
  key_count: 24
  key_types:
    - RSA
    - EC
  fetched: '2026-09-14'
gaps:
  - >-
    No human-readable authentication documentation is reachable: developer.hrblock.com and
    apiportal.hrblock.com resolve but refuse connections from the public internet, so the
    discovery document is the only auth reference an integrator can read.
  - >-
    `none` appears in both id_token_signing_alg_values_supported and
    token_endpoint_auth_methods_supported. That is the PingFederate default advertisement,
    not necessarily an enabled client policy, but it is what the published metadata says.
x-evidence:
  - url: https://login.hrblock.com/.well-known/openid-configuration
    http_status: 200
    content_type: application/json
  - url: https://login.hrblock.com/.well-known/oauth-authorization-server
    http_status: 200
    content_type: application/json
  - url: https://login.hrblock.com/pf/JWKS
    http_status: 200
    content_type: application/json