generated: '2026-08-01'
method: probed
source: https://app.introhive.com/.well-known/oauth-authorization-server
docs: null
note: >-
  Derived verbatim from Introhive's own RFC 8414 OAuth 2.0 Authorization Server Metadata
  documents, probed live on each regional platform host. There is no OpenAPI description
  and no public authentication documentation page, so the profile below is exactly what
  the discovery documents assert and nothing more. Scope semantics are not advertised
  (no `scopes_supported` member), so no scopes/ artifact was written.
summary:
  types:
  - oauth2
  api_key_in: []
  oauth2_flows:
  - authorizationCode
  pkce: true
  pkce_methods:
  - S256
  refresh_tokens: true
  client_authentication:
  - client_secret_post
  - client_secret_basic
  openid_connect: false
  mutual_tls: false
schemes:
- name: OAuth2
  type: oauth2
  sources:
  - well-known/introhive-oauth-authorization-server.json
  - well-known/introhive-ca-oauth-authorization-server.json
  - well-known/introhive-uk-oauth-authorization-server.json
  flows:
  - flow: authorizationCode
    response_types:
    - code
    grant_types:
    - authorization_code
    - refresh_token
    scopes: {}
  instances:
  - region: us
    issuer: https://app.introhive.com
    authorizationUrl: https://app.introhive.com/oauth/authorize
    tokenUrl: https://app.introhive.com/oauth/token
  - region: ca
    issuer: https://ca.introhive.com
    authorizationUrl: https://ca.introhive.com/oauth/authorize
    tokenUrl: https://ca.introhive.com/oauth/token
  - region: uk
    issuer: https://uk.introhive.com
    authorizationUrl: https://uk.introhive.com/oauth/authorize
    tokenUrl: https://uk.introhive.com/oauth/token
client_registration:
  dynamic: false
  console: https://app.introhive.com/oauth/applications
  console_status: 302 to /application_session/sign_in — authenticated tenant admins only
  note: >-
    No RFC 7591 dynamic client registration endpoint is advertised. OAuth applications are
    registered inside the product by a signed-in administrator.
observations:
- The three regional issuers are byte-for-byte identical apart from the host, indicating one
  codebase deployed per data-residency region (US, Canada, UK).
- Endpoint layout (/oauth/authorize, /oauth/token, /oauth/applications) matches the Doorkeeper
  Rails OAuth provider, which is consistent with Introhive's published Ruby repositories.
- 'PKCE is advertised with S256 only: no `plain` challenge method is offered.'
- No token introspection (RFC 7662), revocation (RFC 7009), device authorization (RFC 8628),
  or JWKS endpoint is advertised in the metadata.
x-evidence:
  fetched: '2026-08-01'
  urls:
  - https://app.introhive.com/.well-known/oauth-authorization-server
  - https://ca.introhive.com/.well-known/oauth-authorization-server
  - https://uk.introhive.com/.well-known/oauth-authorization-server
  http_status: 200
  content_type: application/json; charset=utf-8