canonical: https://jentic.com/apis/authentiq.io/authentiq

# Authentiq Connect API

Authentiq Connect is an OAuth 2.0 and OpenID Connect provider that lets developers add passwordless sign-in to web and mobile applications. The API exposes the standard authorization, token, and userinfo endpoints alongside dynamic client registration so applications can be onboarded programmatically. Authentiq supports the authorization code flow, implicit flow, and an iframe-based session check, returning signed JWTs that downstream services can verify without holding user passwords.

## For AI agents

Run an OAuth 2.0/OIDC sign-in flow for an end user, exchange an authorization code for an ID token, and fetch the user profile from /userinfo. Supports dynamic client registration for agent-managed integrations.

## Scope

Does not handle SMS one-time codes, hardware token enrollment, or fine-grained role-based authorization - use for OAuth 2.0 and OpenID Connect sign-in only.

## Capabilities

- Initiate OAuth 2.0 authorization code and implicit flows via the /authorize endpoint
- Exchange authorization codes for signed ID tokens at the /token endpoint
- Register OAuth clients dynamically with POST /client and update or revoke them later
- Retrieve authenticated user profile claims from /userinfo using a bearer access token
- Embed a session-check iframe at /{client_id}/iframe to detect existing sign-in state
- Manage registered clients (list, view, update, delete) using a client registration token

## Use cases

### Passwordless web app sign-in

Add OAuth 2.0/OIDC sign-in to a web application without storing passwords. The app redirects the user to /authorize, Authentiq performs the passwordless challenge, and the app exchanges the returned code at /token for an ID token containing the user's verified identity claims. Integration is typically a few hours for a single client because the endpoints follow the standard OIDC spec.

Example prompt: Build the /authorize URL with response_type=code, scope=openid profile, and a redirect_uri, then exchange the returned code at /token to obtain an ID token

### Dynamic client onboarding

Programmatically register OAuth clients for new tenants or environments instead of using a console. POST /client creates a client, returning credentials that the calling system stores in its own secrets manager. Subsequent PUT and DELETE calls let an automation pipeline rotate redirect URIs or remove clients when a tenant is decommissioned.

Example prompt: Call POST /client with a JSON body specifying client_name and redirect_uris, then store the returned client_id and client_secret in the tenant configuration

### Session presence check via iframe

Detect whether a returning visitor already has an Authentiq session without forcing a redirect. The /{client_id}/iframe endpoint loads in a hidden frame and posts the session state back to the parent page, so a single-page app can decide between showing a sign-in button or proceeding silently. This avoids the visible flash of a full /authorize redirect for already-authenticated users.

Example prompt: Embed the /{client_id}/iframe URL in a hidden iframe and listen for the postMessage event indicating session state

### Agent-driven user identity retrieval

AI agents acting on behalf of a signed-in user can call /userinfo with the user's bearer access token to retrieve verified profile claims (sub, email, name) before personalising downstream actions. Through Jentic the access token is sourced from the credential vault and never exposed to the agent's prompt context, keeping user identity data out of the model's working memory.

Example prompt: Send GET /userinfo with the user's bearer access token in the Authorization header and parse the returned sub and email claims

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /authorize | Start an OAuth 2.0 authorization flow |
| POST | /token | Exchange an authorization code for an ID token |
| GET | /userinfo | Retrieve the authenticated user's profile claims |
| POST | /client | Register a new OAuth client |
| GET | /client | List registered OAuth clients |
| PUT | /client/{client_id} | Update an OAuth client's metadata |
| DELETE | /client/{client_id} | Delete an OAuth client |

## Key resources

- **Authorization** — OAuth 2.0 /authorize endpoint for code and implicit flows
- **Token** — Exchange authorization codes or refresh tokens for ID and access tokens
- **Userinfo** — Retrieve OpenID Connect claims for the authenticated user
- **Clients** — Register, list, update, and delete OAuth clients
- **Session iframe** — Embeddable iframe for silent session presence detection

## Why Jentic

- **Setup:** Wiring the Authentiq Connect API by hand means implementing the OAuth 2.0 and OpenID Connect flow, managing the API key, and handling client registration and token exchange yourself. Through Jentic you install once, import the Authentiq Connect API from the API Directory, store the credential once, and your agent calls it.
- **Permission scoping:** Authentiq puts the client id in the URL path (/client/{client_id}), so a rule can pin your agent to one registered OAuth client: it can read that client and nothing else. You choose the operations it may call, so destructive ones like client update or client deletion are not included unless you add them.
- **Credential handling:** Your Authentiq client secret and registration token are stored once, encrypted, by your own Jentic One instance and injected at execution time. They never enter the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'sign a user in with OAuth' or 'register an OAuth client', and Jentic returns the matching Authentiq operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Auth0 Management API** — Auth0 is a larger identity platform with broader social, enterprise, and MFA connection support
- **Okta API** — Okta provides enterprise SSO, lifecycle management, and policy enforcement on top of OIDC
- **Twilio API** — Twilio adds SMS and voice channels for second-factor delivery alongside an Authentiq sign-in

## FAQ

### What authentication does the Authentiq Connect API use?

Authentiq Connect uses OAuth 2.0 and OpenID Connect. The /token and /userinfo endpoints accept bearer access tokens, and dynamic client management uses a client registration token sent in the Authorization header. Through Jentic, these tokens are stored in the credential vault and injected at call time so the agent never sees raw client secrets.

### Can I register an OAuth client programmatically with the Authentiq Connect API?

Yes. POST /client accepts a JSON body containing client_name and redirect_uris and returns a client_id and client_secret. You can later list clients with GET /client, update one with PUT /client/{client_id}, or remove it with DELETE /client/{client_id}.

### What are the rate limits for the Authentiq Connect API?

Authentiq does not publish hard rate limits in the OpenAPI spec. Production deployments should treat /authorize and /token as user-initiated and apply standard exponential backoff on 429 responses; reach out to support@authentiq.com for tenant-specific quotas.

### How do I sign a user in with the Authentiq Connect API through Jentic?

Search Jentic for 'OAuth 2.0 sign-in flow', load the /authorize and /token operation schemas, then redirect the user to /authorize with response_type=code and exchange the returned code at /token. Get started with Jentic One, the self-hosted execution layer.

### Does the Authentiq Connect API support OpenID Connect discovery?

The /userinfo endpoint returns standard OIDC claims (sub, email, name, picture) for the user identified by the bearer access token. The authorization, token, and userinfo endpoints conform to the OpenID Connect specification, so libraries that handle generic OIDC providers work with Authentiq.

### Is the Authentiq Connect API free?

Authentiq offers free developer tiers for low-volume integrations and paid plans for production traffic. Pricing is not encoded in the OpenAPI spec; check https://www.authentiq.com/ for the current plan list.

### Can I limit what my agent is allowed to do with the Authentiq Connect API?

Yes. Because you run Jentic One yourself, your own rules decide which Authentiq operations and credentials the agent may use. Since the client id sits in the URL path (/client/{client_id}), you can pin the agent to a single registered OAuth client so it reads only that client and nothing else. You choose the operations it may call, so you can allow /authorize, /token, and /userinfo while leaving destructive ones like PUT /client/{client_id} or DELETE /client/{client_id} out unless you add them.