Bring Your Own Auth Server#

If you use your own authorization server instead of the playground's, it must support the JWT Bearer grant flow and trust the playground IDP as an issuer.

Requirements#

1. Expose discovery metadata at /.well-known/oauth-authorization-server (RFC 8414) or /.well-known/openid-configuration. The playground tries RFC 8414 first and falls back to OIDC discovery. Include at minimum:

   • token_endpoint: where the JWT Bearer grant is sent
   • jwks_uri: where your public keys are published

2. Support JWT Bearer grant: accept grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer

3. Validate the ID-JAG:

   • Check typ header is oauth-id-jag+jwt
   • Verify signature against the playground IDP's JWKS: https://idp.xaa.dev/jwks

4. Validate issuer: the iss claim in the ID-JAG must match the playground IDP: https://idp.xaa.dev

5. Issue access tokens: return JWTs with the requested scopes, signed with your own keys

Token endpoint request#

Your auth server's token endpoint will receive a request like:

Credentials are sent in the POST body (client_secret_post). Do not use an Authorization: Basic header.

ID-JAG Structure#

The assertion parameter contains an ID-JAG (Identity Assertion Authorization Grant), a JWT with these characteristics:

Expected response#

Your token endpoint should return:

Minimal auth server examples#

Next step#

Once your auth server handles the JWT Bearer grant, set up your resource server to validate the access tokens it issues. See REST API Setup or MCP Server Setup, then run the flow via Test Your Resource App.