platform.reference
The protocol flow, standards coverage, configuration workflow, agent delegation, events, and security controls behind every trace — for when you want to verify the claims on the front page.
protocol.flow
Authorization Code with PKCE, as it actually crosses the wire — and what Authometry checks at each hop before anything is issued.
Interactive example · demo data
02 / 08
The browser is sent to the authorization endpoint with a PKCE challenge.
Authometry checks
Recorded in the trace as
standards
OAuth 2.0 and OpenID Connect, implemented plainly. Any compliant client library works; there is no proprietary protocol to adopt or migrate away from.
Deliberately not supported
Authometry ships conformance-oriented tests. It is not OpenID Certified; certification requires a separate submission to the OpenID Foundation.
Protocol documentationconfiguration
Define applications, scopes, claims, and policies as YAML next to your code. Each environment is a target; every change is a pull request.
git diffauthometry validateauthometry planauthometry applyInteractive example · demo data
Restrict Itsagram media to workspace members #184
jiayang wants to merge media-access into main
validate plan+31 −1
apiVersion: authometry.dev/v1alpha1
kind: Policy
metadata:
name: workspace-member
spec:
displayName: Workspace member
description: Only Bellaire Media members can use Itsagram.
enabled: true
applications: [itsagram-web]
match:
all:
- field: user.groups
operator: contains
value: bellaire-media
decision:
allow: true
otherwise:
deny:
code: access_denied
message: A Bellaire Media workspace account is required.
What Authometry applies to production
itsagram-webuser.groupscontainsbellaire-mediaaccess_deniedA Bellaire Media workspace account is required.Managed by manifest policies/workspace-member.yaml
$ authometry validate --directory authometry
✓ 1 Application resources valid
✓ 1 AuthometryInstance resources valid
✓ 1 Policy resources valid
✓ 1 Scope resources valid
Configuration is valid.
$ authometry plan --directory authometry
~ Application/itsagram-web
= AuthometryInstance/primary
+ Policy/workspace-member
+ Scope/media-read
Plan: 2 create, 1 update, 0 delete, 1 unchanged.
agents
Agents, services, CLIs, and MCP clients act on someone’s behalf. Authometry gives each a registered identity, bounds what a task may do, and records who acted for whom.
Interactive example · demo data
Authorization Code + PKCEClient CredentialsDevice AuthorizationCode + PKCE + resourceSigned PAR + DPoPScoped, audited authorization
Disabling an agent disables its OAuth client and revokes every active grant.
caption-assistantoperated by bellaire-media
https://api.itsagram.comPOST /oauth/par Authorization: AgentAssertion eyJhbGciOi…
Access token, bound to the agent’s key
{
"sub": "5b0f6c1e…",
"act": { "sub": "caption-assistant", "operator": "bellaire-media" },
"aud": "https://api.itsagram.com",
"scope": "media:read media:write",
"authometry_grant_id": "0f9b…",
"cnf": { "jkt": "NzbLsXh8uDCcd…" }
}
events
Every request becomes a trace; every change becomes an audit event. Read them from the dashboard, the management API, or an MCP client — or have them pushed to you as signed webhooks.
/api/v1/traces and /api/v1/events with scoped tokenslist_authorization_traces, get_authorization_tracex-request-id on every response, for your own logsInteractive example · demo data
productiontraces and audit events
GET /api/v1/traces/req_Hd4sZ0rWb2
authorization: Bearer amt_…
{
"request_id": "req_Hd4sZ0rWb2",
"status": "denied",
"event_type": "authorization_request",
"application_name": "Itsagram Web",
"client_id": "itsagram-web",
"started_at": "2026-09-28T16:12:15.285Z"
}
Event types and payload fields match what Authometry records and delivers. Webhooks carry audit and security events; traces are read through the API and MCP.
security
No badges, no adjectives. These are the controls in the code, stated precisely enough to verify.
Read the security model(opens in a new tab)source
Authometry is open source and self-hosted. The code that evaluates a policy, signs a token, or redacts a trace is the code you can read, run, and change.
Your applications
Your network
Web origin Next.js :3000
Protocol and API server Express :4000, private
philosophy
OAuth errors are deliberately terse on the wire — clients shouldn’t learn your configuration. Operators should. Authometry keeps both views.
error=access_deniedpolicy_deniedPolicy Workspace member denied the request.user.groups did not contain "bellaire-media". Message: A Bellaire Media workspace account is required.400 redirect_uri_mismatchredirect_uri_mismatchThe requested redirect URI is not registered for Itsagram Web.Received https://itsagram.com/callback. Registered https://itsagram.com/auth/callback.error=invalid_requestpkce_requiredThis application requires an S256 code challenge.Generate a code verifier and send its S256 challenge with the authorization request.400 invalid_grantrefresh_token_reuseA rotated refresh token was reused. The token family was revoked.Recorded as a high-severity security event in the audit log.