generated: '2026-08-14'
method: probed
source: https://auth.mybots.pro/.well-known/openid-configuration
note: >-
  Derived from the provider's OWN live OAuth 2.0 / OpenID Connect discovery document, not
  from an OpenAPI — myBots publishes no OpenAPI anywhere (see conformance/ for the full
  negative probe record). Every value below is copied verbatim from that document or was
  observed on a live response; nothing is inferred. The server is OpenIddict (identified by
  the error_uri documentation.openiddict.com returned by the token endpoint).
docs: null
docs_note: >-
  myBots publishes no developer authentication guide. The discovery document IS the only
  machine-readable auth contract they serve.
summary:
  types: [oauth2, openIdConnect]
  api_key_in: []
  oauth2_flows: [authorizationCode, clientCredentials, password, refreshToken]
  bearer: true
  pkce: true
schemes:
- name: OpenIDConnect
  type: openIdConnect
  openIdConnectUrl: https://auth.mybots.pro/.well-known/openid-configuration
  issuer: https://auth.mybots.pro/
  source: well-known/mybotspro-openid-configuration.json
- name: OAuth2
  type: oauth2
  source: well-known/mybotspro-openid-configuration.json
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth.mybots.pro/connect/authorize
    tokenUrl: https://auth.mybots.pro/connect/token
    refreshUrl: https://auth.mybots.pro/connect/token
  - flow: clientCredentials
    tokenUrl: https://auth.mybots.pro/connect/token
  - flow: password
    tokenUrl: https://auth.mybots.pro/connect/token
    note: >-
      Resource-owner password credentials is advertised in grant_types_supported. OAuth 2.1
      deprecates this grant; recorded because the provider advertises it, not endorsed.
- name: BearerToken
  type: http
  scheme: bearer
  source: observed response header
  evidence:
    url: https://client.mybots.pro/api/Subscribe/program
    http_status: 401
    header: 'www-authenticate: Bearer'
    observed: '2026-08-14'
endpoints:
  authorization: https://auth.mybots.pro/connect/authorize
  token: https://auth.mybots.pro/connect/token
  introspection: https://auth.mybots.pro/connect/introspect
  userinfo: https://auth.mybots.pro/connect/userinfo
  end_session: https://auth.mybots.pro/connect/logout
  jwks: https://auth.mybots.pro/.well-known/jwks
grant_types_supported:
- authorization_code
- client_credentials
- password
- refresh_token
- verification_token
- session_token
non_standard_grants:
- grant: verification_token
  note: >-
    Not an IANA-registered OAuth grant type. Undocumented by myBots; almost certainly the
    phone/email verification exchange the SPA drives via /api/verification.
- grant: session_token
  note: Not an IANA-registered OAuth grant type. Undocumented by myBots.
token_endpoint_auth_methods_supported:
- client_secret_post
- private_key_jwt
- client_secret_basic
code_challenge_methods_supported: [plain, S256]
pkce_note: >-
  S256 is supported, but so is `plain`, which PKCE (RFC 7636 §7.2) and OAuth 2.1 both
  discourage; a client that negotiates `plain` gets no real protection.
id_token_signing_alg_values_supported: [RS256]
response_types_supported: [code]
response_modes_supported: [query, form_post, fragment]
subject_types_supported: [public]
prompt_values_supported: [consent, login, none, select_account]
security_posture:
  require_pushed_authorization_requests: false
  claims_parameter_supported: false
  request_parameter_supported: false
  request_uri_parameter_supported: false
  tls_client_certificate_bound_access_tokens: false
  authorization_response_iss_parameter_supported: true
anonymous_surface:
- api: myBots Web Chat Public API
  endpoint: https://notification.mybots.pro/api/IntegrationApp/public/webchat/{channel}/config
  auth: none
  note: >-
    Called by the published widget loader with `credentials: "omit"`. The channel public key
    in the URL is the only identifier; the backend enforces a per-channel domain allow-list
    against the embedding page origin instead of a token.