generated: '2026-08-25' method: probed source: >- https://auth.leapfinance.com/.well-known/openid-configuration (HTTP 200, application/json, 2523 bytes, fetched 2026-08-25) — saved verbatim to well-known/leap-finance-openid-configuration.json name: Leap Finance authentication description: >- Authentication profile for Leap Finance Inc., established entirely by probing the company's own identity tenant. Leap Finance publishes no API reference and no OpenAPI document, so there are no securitySchemes to derive from. What it does serve is a complete, unauthenticated OpenID Connect discovery document at auth.leapfinance.com — an Auth0 tenant on the company's own domain — which describes the identity surface behind its consumer loan application and partner portal. caveat: >- This describes an END-USER IDENTITY surface, not a developer API authentication model. The endpoints below authenticate borrowers and partner-portal operators into Leap Finance's own web applications. No public API accepts these tokens, because no public API is documented. Do not read this artifact as evidence that Leap Finance offers programmatic access. provider: Auth0 issuer: https://auth.leapfinance.com/ tenant_cname: auth-leapfinance-cd-gp8aezmavuzbqnge.edge.tenants.auth0.com schemes: - id: openIdConnect type: openIdConnect openIdConnectUrl: https://auth.leapfinance.com/.well-known/openid-configuration description: >- OpenID Connect 1.0, discovered live. Also served, byte-identical, at the RFC 8414 path /.well-known/oauth-authorization-server. - id: oauth2 type: oauth2 description: OAuth 2.0 authorization server fronting the same tenant. flows: authorizationCode: authorizationUrl: https://auth.leapfinance.com/authorize tokenUrl: https://auth.leapfinance.com/oauth/token refreshUrl: https://auth.leapfinance.com/oauth/token clientCredentials: tokenUrl: https://auth.leapfinance.com/oauth/token deviceCode: deviceAuthorizationUrl: https://auth.leapfinance.com/oauth/device/code tokenUrl: https://auth.leapfinance.com/oauth/token implicit: authorizationUrl: https://auth.leapfinance.com/authorize note: >- Advertised but deprecated by OAuth 2.1; listed here because the tenant declares it, not because it is recommended. endpoints: authorization: https://auth.leapfinance.com/authorize token: https://auth.leapfinance.com/oauth/token userinfo: https://auth.leapfinance.com/userinfo jwks: https://auth.leapfinance.com/.well-known/jwks.json revocation: https://auth.leapfinance.com/oauth/revoke registration: https://auth.leapfinance.com/oidc/register device_authorization: https://auth.leapfinance.com/oauth/device/code backchannel_authentication: https://auth.leapfinance.com/bc-authorize mfa_challenge: https://auth.leapfinance.com/mfa/challenge global_token_revocation: https://auth.leapfinance.com/oauth/global-token-revocation/connection/{connectionName} grant_types_supported: - client_credentials - authorization_code - refresh_token - password - implicit - urn:ietf:params:oauth:grant-type:device_code - urn:ietf:params:oauth:grant-type:token-exchange - urn:ietf:params:oauth:grant-type:jwt-bearer - http://auth0.com/oauth/grant-type/password-realm - http://auth0.com/oauth/grant-type/passwordless/otp - http://auth0.com/oauth/grant-type/mfa-oob - http://auth0.com/oauth/grant-type/mfa-otp - http://auth0.com/oauth/grant-type/mfa-recovery-code client_authentication: token_endpoint_auth_methods_supported: - client_secret_basic - client_secret_post - private_key_jwt - none token_endpoint_auth_signing_alg_values_supported: [RS256, RS384, PS256] token_security: pkce: supported: true code_challenge_methods_supported: [S256, plain] note: >- S256 is supported. `plain` is also advertised, which RFC 7636 permits but discourages for clients capable of S256. dpop: supported: true dpop_signing_alg_values_supported: [ES256] id_token_signing_alg_values_supported: [HS256, RS256, PS256] note: >- HS256 is advertised for ID token signing alongside RS256/PS256. HS256 is a symmetric algorithm and is only appropriate for confidential clients. mfa: supported: true evidence: >- mfa_challenge_endpoint plus the mfa-oob / mfa-otp / mfa-recovery-code grant types in the discovery document. registration: dynamic_client_registration: true endpoint: https://auth.leapfinance.com/oidc/register note: >- RFC 7591 dynamic client registration endpoint is advertised. Whether it is open or requires an initial access token was NOT tested — this pipeline does not attempt registration against a live identity tenant. subject_types_supported: [public] response_modes_supported: [query, fragment, form_post] response_types_supported: - code - token - id_token - code token - code id_token - token id_token - code token id_token request_object: request_parameter_supported: false request_uri_parameter_supported: false claims_supported: - aud - auth_time - created_at - email - email_verified - exp - family_name - given_name - iat - identities - iss - name - nickname - phone_number - picture - sub scopes: reference: scopes/leap-finance-scopes.yml other_hosts: - host: api.leapscholar.com observed: >- Rejects all unauthenticated requests. Returns HTTP 403 with an empty body on /, /v1/* and every /.well-known/* path, and HTTP 400 application/problem+json on other paths. No WWW-Authenticate header is returned, so the expected credential type is not advertised. Authentication model undetermined. - host: partner.leapfinance.com observed: >- React single-page application titled "Leap Finance" that renders nothing without JavaScript. A partner portal login; no machine-readable auth metadata. - host: portal.leapfinance.com observed: >- Next.js application whose served body is "Home Visit CMS Login" — an internal operations CMS. Not a developer surface.