Bring Your Own Auth Server#

If you use your own authorization server instead of the playground's, it must support the JWT Bearer grant flow and trust the playground IDP as an issuer.

Requirements#

1. Expose discovery metadata at /.well-known/oauth-authorization-server (RFC 8414) or /.well-known/openid-configuration. The playground tries RFC 8414 first and falls back to OIDC discovery. Include at minimum:

   • token_endpoint: where the JWT Bearer grant is sent
   • jwks_uri: where your public keys are published

2. Support JWT Bearer grant: accept grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer

3. Validate the ID-JAG, in this order. The order is not cosmetic. Binding the issuer before trusting the signature is what stops an attacker signing their own ID-JAG with their own key and naming your customer's issuer inside it:

   1. Check the typ header is oauth-id-jag+jwt
   2. Match iss against an issuer you have explicitly registered (for the playground: https://idp.xaa.dev) and reject unknown issuers with invalid_grant
   3. Only then verify the signature against that issuer's JWKS. For the playground, that is https://idp.xaa.dev/jwks
   4. Validate iat and exp
   5. Validate client_id matches the client that authenticated on this request
   6. Validate aud matches your auth server's own URL
   7. Resolve the subject from sub. If the grant may carry a structured sub_id instead, see Own Auth Server (SAML)

4. Do not issue a refresh token. Return an access token only. A refresh token would give the client durable access the IdP can no longer revoke; the ID-JAG's short lifetime is what forces the client back to the IdP.

5. Issue access tokens: return JWTs with the requested scopes, signed with your own keys

6. Advertise the grant profile in your discovery document: "authorization_grant_profiles_supported": ["urn:ietf:params:oauth:grant-profile:id-jag"]

Token endpoint request#

Your auth server's token endpoint will receive a request like:

Credentials are sent in the POST body (client_secret_post). Do not use an Authorization: Basic header.

ID-JAG Structure#

The assertion parameter contains an ID-JAG (Identity Assertion Authorization Grant), a JWT with these characteristics:

Expected response#

Your token endpoint should return:

Minimal auth server examples#

Next step#

Once your auth server handles the JWT Bearer grant, set up your resource server to validate the access tokens it issues. See REST API Setup or MCP Server Setup, then run the flow via Test Your Resource App.