> ## Documentation Index
> Fetch the complete documentation index at: https://bkey.id/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# OIDC Discovery

> OpenID Connect discovery document. Lists all supported endpoints, grant types, scopes, and signing algorithms.



## OpenAPI

````yaml get /.well-known/openid-configuration
openapi: 3.1.0
info:
  title: BKey API
  description: Biometric approval infrastructure for AI agents — OAuth 2.1 + CIBA
  version: 1.0.0
  contact:
    name: BKey
    url: https://bkey.id
    email: dev@bkey.id
  license:
    name: Apache-2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
  - url: https://api.bkey.id
    description: Production
security:
  - bearerAuth: []
tags:
  - name: OAuth
    description: OAuth 2.1 token, device auth, CIBA, revocation
  - name: Checkout
    description: Agent-initiated checkout with biometric approval
  - name: Vault
    description: Encrypted secret storage with biometric access
  - name: Payments
    description: Payment methods and shared payment tokens
  - name: Identity
    description: DID and identity management
paths:
  /.well-known/openid-configuration:
    get:
      tags:
        - OAuth
      summary: OIDC Discovery
      description: >-
        OpenID Connect discovery document. Lists all supported endpoints, grant
        types, scopes, and signing algorithms.
      responses:
        '200':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                properties:
                  issuer:
                    type: string
                    format: uri
                  userinfo_endpoint:
                    type: string
                    format: uri
                  jwks_uri:
                    type: string
                    format: uri
                  token_endpoint:
                    type: string
                    format: uri
                  device_authorization_endpoint:
                    type: string
                    format: uri
                  backchannel_authentication_endpoint:
                    type: string
                    format: uri
                  revocation_endpoint:
                    type: string
                    format: uri
                  grant_types_supported:
                    type: array
                    items:
                      type: string
                  backchannel_token_delivery_modes_supported:
                    type: array
                    items:
                      type: string
                  token_endpoint_auth_methods_supported:
                    type: array
                    items:
                      type: string
                  scopes_supported:
                    type: array
                    items:
                      type: string
                  response_types_supported:
                    type: array
                    items:
                      type: string
                  subject_types_supported:
                    type: array
                    items:
                      type: string
                  id_token_signing_alg_values_supported:
                    type: array
                    items:
                      type: string
                required:
                  - issuer
                  - userinfo_endpoint
                  - jwks_uri
                  - token_endpoint
                  - device_authorization_endpoint
                  - backchannel_authentication_endpoint
                  - revocation_endpoint
                  - grant_types_supported
                  - backchannel_token_delivery_modes_supported
                  - token_endpoint_auth_methods_supported
                  - scopes_supported
                  - response_types_supported
                  - subject_types_supported
                  - id_token_signing_alg_values_supported
                additionalProperties: false
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: JWT
      description: EdDSA-signed JWT obtained via OAuth 2.1 client_credentials or CIBA

````