Account OAuth

Account OAuth lets an application sign in an EnderDash user through OpenID Connect. It uses the user's dashboard account and the EnderDash sign-in and consent pages.

For in-game identity proof, use Game OAuth. Game OAuth has a different issuer, client registry, and set of claims.

Discovery and endpoints

Load discovery from https://app.enderdash.com/.well-known/openid-configuration. The production issuer is https://app.enderdash.com/api/auth. Keep the /api/auth path when you configure the expected issuer.

All paths use the app origin. Read endpoint URLs from discovery when you configure an OIDC library. For local development, replace the origin with https://app.enderdash.localhost:1355.

Client registration

An EnderDash platform admin registers account clients under Admin > OAuth Clients. Organization owners and admins do not receive this permission through their organization role. Public dynamic client registration is available for MCP clients. Other account clients can still be registered by a platform admin.

The admin supplies the client name, redirect URIs, scopes, token authentication method, and PKCE requirement. The client can use client_secret_basic or client_secret_post. The current admin flow creates confidential web clients with the authorization-code grant.

The generated client ID starts with edc_, unless the admin supplies a custom ID. Client secrets start with edocs_. Creation and rotation return the secret once. Store it in the application's backend.

Scopes and grants

Account clients can receive refresh tokens when their allowed and requested scopes include offline_access. Send the refresh token to the token endpoint with grant_type=refresh_token and the registered client authentication. Store the latest returned refresh token when you renew access. Use the response's expires_in value to schedule renewal.

Discovery describes provider capabilities. The current admin interface creates authorization-code clients, not service clients for the client-credentials flow.

Sign-in flow

1. Configure an OIDC client with discovery, the registered callback URL, and the client credentials.
2. Start authorization with response_type=code, requested scopes, a random state, and a nonce.
3. Use PKCE with S256 and retain the verifier for the callback.
4. Let EnderDash handle sign-in and any required consent.
5. Validate the callback state before exchanging its code from your backend.
6. Validate the ID token's signature, issuer, audience, expiration, and nonce through your OIDC library.
7. Use the access token at the discovered userinfo endpoint when you need user claims.

Use the issuer and sub together as the account identity. An email address or display name can change.

Access boundaries

Account OAuth signs a user into your application. It does not grant organization membership or server access. The scopes listed here do not represent server-management permissions.

MCP server

The MCP server uses the account OAuth provider and the resource at https://app.enderdash.com/api/mcp. Clients can discover the authorization server from the protected-resource metadata endpoint above. EnderDash currently supports dynamic client registration for MCP clients.

Follow Connect an MCP Client to sign in and try the tools. See the MCP Server reference for the tool list, scopes, and access rules.

The HTTP API accepts an EnderDash session or user API key. It does not accept an OAuth access token as a replacement for those credentials. Game OAuth tokens cannot authenticate this provider's userinfo endpoint.

Troubleshooting

Related

• Game OAuth
• MCP Server
• HTTP API
• Access Model