generated: '2026-09-04'
method: probed
source: https://auth.wand.ai/realms/master/.well-known/openid-configuration
name: Wand authentication profile
description: >-
  Derived entirely from Wand's own anonymous OpenID Connect discovery document — there is no OpenAPI
  and no public authentication documentation to read. Wand runs Keycloak at auth.wand.ai; the master
  realm is the only realm that answers. Nothing here is inferred from prose: every value below is a
  field of the discovery document saved verbatim at well-known/wand-ai-openid-configuration.json.
x-evidence:
  fetched: '2026-09-04'
  url: https://auth.wand.ai/realms/master/.well-known/openid-configuration
  http_status: 200
  content_type: application/json;charset=UTF-8
provider: Keycloak
issuer: https://auth.wand.ai/realms/master
schemes:
- id: wand_openid_connect
  type: openIdConnect
  openIdConnectUrl: https://auth.wand.ai/realms/master/.well-known/openid-configuration
  description: OpenID Connect 1.0 provider for the Wand platform.
- id: wand_oauth2
  type: oauth2
  flows:
  - name: authorization_code
    authorizationUrl: https://auth.wand.ai/realms/master/protocol/openid-connect/auth
    tokenUrl: https://auth.wand.ai/realms/master/protocol/openid-connect/token
    pkce: true
    pkce_methods: [S256, plain]
  - name: client_credentials
    tokenUrl: https://auth.wand.ai/realms/master/protocol/openid-connect/token
  - name: password
    tokenUrl: https://auth.wand.ai/realms/master/protocol/openid-connect/token
    note: Resource-owner password grant is advertised; discouraged by OAuth 2.1.
  - name: implicit
    authorizationUrl: https://auth.wand.ai/realms/master/protocol/openid-connect/auth
    note: Advertised; discouraged by OAuth 2.1.
  - name: refresh_token
    tokenUrl: https://auth.wand.ai/realms/master/protocol/openid-connect/token
  - name: device_code
    deviceAuthorizationUrl: https://auth.wand.ai/realms/master/protocol/openid-connect/auth/device
    grant: 'urn:ietf:params:oauth:grant-type:device_code'
  - name: ciba
    backchannelAuthenticationUrl: https://auth.wand.ai/realms/master/protocol/openid-connect/ext/ciba/auth
    grant: 'urn:openid:params:grant-type:ciba'
- id: wand_mtls
  type: mutualTLS
  description: >-
    Certificate-bound access tokens are supported (tls_client_certificate_bound_access_tokens: true)
    and tls_client_auth is an accepted token-endpoint auth method. mTLS endpoint aliases are
    published for token, revocation, introspection, device, registration, userinfo, PAR and CIBA.
endpoints:
  authorization: https://auth.wand.ai/realms/master/protocol/openid-connect/auth
  token: https://auth.wand.ai/realms/master/protocol/openid-connect/token
  userinfo: https://auth.wand.ai/realms/master/protocol/openid-connect/userinfo
  introspection: https://auth.wand.ai/realms/master/protocol/openid-connect/token/introspect
  revocation: https://auth.wand.ai/realms/master/protocol/openid-connect/revoke
  end_session: https://auth.wand.ai/realms/master/protocol/openid-connect/logout
  jwks: https://auth.wand.ai/realms/master/protocol/openid-connect/certs
  registration: https://auth.wand.ai/realms/master/clients-registrations/openid-connect
  pushed_authorization_request: https://auth.wand.ai/realms/master/protocol/openid-connect/ext/par/request
  device_authorization: https://auth.wand.ai/realms/master/protocol/openid-connect/auth/device
  backchannel_authentication: https://auth.wand.ai/realms/master/protocol/openid-connect/ext/ciba/auth
token_endpoint_auth_methods:
- private_key_jwt
- client_secret_basic
- client_secret_post
- tls_client_auth
- client_secret_jwt
response_modes:
- query
- fragment
- form_post
- query.jwt
- fragment.jwt
- form_post.jwt
- jwt
claims:
- aud
- sub
- iss
- auth_time
- name
- given_name
- family_name
- preferred_username
- email
- acr
features:
  pkce: true
  par_supported: true
  par_required: false
  jarm: true
  request_object: true
  iss_in_authorization_response: true
  front_channel_logout: true
  back_channel_logout: true
gaps:
- >-
  No public API-key or bearer-token documentation exists for the Wand AI Workforce API at
  api.wand.ai. Whether that API accepts these OIDC tokens could not be confirmed — every probed
  path returned HTTP 503 and Wand publishes no developer reference.
- >-
  Only the Keycloak `master` realm answers. If tenants are provisioned in per-customer realms,
  those realm names are not publicly discoverable.