VPNDetectionVPNDetection

Register

POST
/oauth/register

RFC 7591 dynamic client registration, for a client that cannot use a Client ID Metadata Document. Post your client's metadata as JSON, then use the client_id in the answer at /oauth/authorize and /oauth/token. Nothing is kept until a person approves your client, so registering again costs nothing and leaves nothing to clean up.

Each redirect URI must be https on a public host name, or http on a loopback address (127.0.0.1, [::1], localhost), which then matches on any port. A custom URI scheme is refused: use a loopback redirect instead. So is a host on one of our own domains.

client_name is shown to the person as your client's own claim, with where its redirect goes beside it. A name that renders blank, or mixes Latin letters with Cyrillic or Greek ones, is shown as an unnamed application.

The client is public whatever you ask for: token_endpoint_auth_method comes back none, there is no client secret, and every authorization proves itself with PKCE. It may be granted apikeys.use at most.

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

curl -X POST "https://api.vpndetection.io/oauth/register" \  -H "Content-Type: application/json" \  -d '{    "redirect_uris": [      "string"    ]  }'
{
  "client_id": "string",
  "client_id_issued_at": 0,
  "client_name": "string",
  "redirect_uris": [
    "string"
  ],
  "grant_types": [
    "string"
  ],
  "response_types": [
    "string"
  ],
  "token_endpoint_auth_method": "string",
  "scope": "string"
}
{
  "error": "string",
  "error_description": "string"
}

Device authorization POST

Starts the device flow. Show the `user_code` to the person and send them to `verification_uri`; `verification_uri_complete` has the code already embedded, which is what to open if you can open a browser at all. Then poll `/oauth/token`, no faster than `interval` seconds.

Authorize GET

The browser entry point for the authorization-code flow. This is a redirect target, not something to call from code. Any client may sign in without registering first by using a Client ID Metadata Document: make `client_id` an https URL that serves your client's metadata as JSON, naming that same URL as its `client_id`, with `token_endpoint_auth_method` `none` and your `redirect_uris`. An https redirect URI must be on the same origin as the `client_id`; a loopback one (`http://127.0.0.1`, `http://[::1]`, `http://localhost`) matches on any port. Such a client is granted `apikeys.use` at most. A client registered at `/oauth/register` uses the `client_id` it was given and one of the `redirect_uris` it registered. An unknown `client_id` or an unregistered `redirect_uri` is shown to the person and never redirected, because sending an error to an address we have not verified belongs to you is how an open redirector works. Any other error in the request is shown to the person too: anyone can make a client, so its `redirect_uri` is verified only as its own (RFC 9700 section 4.11.2). Only the person's answer comes back to your `redirect_uri`: a `code`, or `error` `access_denied`, each with your `state` and `iss`.