{
  "product": {
    "name": "Bhauu Auth",
    "canonical_url": "https://auth.bhauu.online/",
    "docs_url": "https://auth.bhauu.online/docs/",
    "developer_portal_url": "https://auth.bhauu.online/login",
    "terminology": {
      "Bhauu": "Parent brand.",
      "Bhauu Identity": "Canonical identity shared across Bhauu products and connected applications.",
      "Bhauu Auth": "Hosted authentication and OAuth authorization gateway.",
      "Bhauu Account": "User-facing identity and account control centre.",
      "Developer Portal": "Private application registration and configuration surface.",
      "Connected App": "An application authorized to use a user's Bhauu Identity; it retains its own product data and local sessions."
    }
  },
  "documentation": [
    {
      "title": "Bhauu Auth Documentation",
      "url": "https://auth.bhauu.online/docs/",
      "category": "overview",
      "summary": "Start here for the public Bhauu Auth integration contract.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/developers/",
        "https://auth.bhauu.online/integrations/"
      ]
    },
    {
      "title": "Getting started",
      "url": "https://auth.bhauu.online/docs/getting-started/",
      "category": "getting-started",
      "summary": "A practical path from client registration to application sign-in.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/oauth/",
        "https://auth.bhauu.online/docs/pkce/",
        "https://auth.bhauu.online/docs/redirect-uris/"
      ]
    },
    {
      "title": "OAuth authorization",
      "url": "https://auth.bhauu.online/docs/oauth/",
      "category": "concept",
      "summary": "Authentication establishes identity; authorization grants a registered client access.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/docs/security/"
      ]
    },
    {
      "title": "PKCE S256",
      "url": "https://auth.bhauu.online/docs/pkce/",
      "category": "concept",
      "summary": "PKCE binds the one-time code to the application transaction that started sign-in.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/docs/security/"
      ]
    },
    {
      "title": "Redirect URIs",
      "url": "https://auth.bhauu.online/docs/redirect-uris/",
      "category": "concept",
      "summary": "The callback is a security boundary, not a loose return URL.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/docs/security/"
      ]
    },
    {
      "title": "Tokens and response fields",
      "url": "https://auth.bhauu.online/docs/tokens/",
      "category": "concept",
      "summary": "A token grants scoped access; it is not an identity record or an application session.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/docs/security/"
      ]
    },
    {
      "title": "Sessions and continuity",
      "url": "https://auth.bhauu.online/docs/sessions/",
      "category": "concept",
      "summary": "One user can have several related but distinct session and authorization states.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/docs/security/"
      ]
    },
    {
      "title": "UserInfo",
      "url": "https://auth.bhauu.online/docs/userinfo/",
      "category": "api",
      "summary": "Read scoped identity claims for the token subject, not an arbitrary user.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/tokens/",
        "https://auth.bhauu.online/docs/sessions/"
      ]
    },
    {
      "title": "Revocation",
      "url": "https://auth.bhauu.online/docs/revocation/",
      "category": "api",
      "summary": "Bhauu-side token/session revocation is distinct from app-owned logout.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/sessions/",
        "https://auth.bhauu.online/docs/introspection/"
      ]
    },
    {
      "title": "Token introspection",
      "url": "https://auth.bhauu.online/docs/introspection/",
      "category": "api",
      "summary": "A confidential backend can check whether a token is currently active.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/revocation/",
        "https://auth.bhauu.online/docs/security/"
      ]
    },
    {
      "title": "Errors and troubleshooting",
      "url": "https://auth.bhauu.online/docs/errors/",
      "category": "api",
      "summary": "Handle failures at the boundary that owns them.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/docs/security/"
      ]
    },
    {
      "title": "Security guide",
      "url": "https://auth.bhauu.online/docs/security/",
      "category": "security",
      "summary": "Keep the OAuth transaction and your application session secure end to end.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/pkce/",
        "https://auth.bhauu.online/docs/redirect-uris/"
      ]
    },
    {
      "title": "Build authentication with Bhauu Auth",
      "url": "https://auth.bhauu.online/developers/",
      "category": "overview",
      "summary": "Connect a registered application to Bhauu-hosted sign-in without maintaining a separate identity for each product.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/",
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/integrations/"
      ]
    },
    {
      "title": "Integration guides",
      "url": "https://auth.bhauu.online/integrations/",
      "category": "overview",
      "summary": "Use the same Authorization Code and PKCE S256 contract across different application architectures.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/docs/security/"
      ]
    }
  ],
  "integrations": [
    {
      "title": "JavaScript integration",
      "url": "https://auth.bhauu.online/integrations/javascript/",
      "category": "integration",
      "summary": "Use Web Crypto and an exact registered callback for a browser-only client.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/docs/security/"
      ],
      "architecture": "browser"
    },
    {
      "title": "TypeScript integration",
      "url": "https://auth.bhauu.online/integrations/typescript/",
      "category": "integration",
      "summary": "Apply the same browser contract with explicit transaction types.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/docs/security/"
      ],
      "architecture": "browser"
    },
    {
      "title": "React integration",
      "url": "https://auth.bhauu.online/integrations/react/",
      "category": "integration",
      "summary": "Start the redirect from an event handler and handle the callback in a dedicated route.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/docs/security/"
      ],
      "architecture": "browser"
    },
    {
      "title": "Node.js integration",
      "url": "https://auth.bhauu.online/integrations/nodejs/",
      "category": "integration",
      "summary": "Keep the login transaction and any registered client secret on the server.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/docs/security/"
      ],
      "architecture": "server-backed"
    },
    {
      "title": "Next.js integration",
      "url": "https://auth.bhauu.online/integrations/nextjs/",
      "category": "integration",
      "summary": "Use server routes for the OAuth transaction and callback.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/docs/security/"
      ],
      "architecture": "server-backed"
    },
    {
      "title": "PHP integration",
      "url": "https://auth.bhauu.online/integrations/php/",
      "category": "integration",
      "summary": "Keep state and verifier in a protected PHP session.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/docs/security/"
      ],
      "architecture": "server-backed"
    },
    {
      "title": "Laravel integration",
      "url": "https://auth.bhauu.online/integrations/laravel/",
      "category": "integration",
      "summary": "Use Laravel sessions for a short-lived OAuth transaction.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/docs/security/"
      ],
      "architecture": "server-backed"
    },
    {
      "title": "Python integration",
      "url": "https://auth.bhauu.online/integrations/python/",
      "category": "integration",
      "summary": "Generate the transaction on the server and exchange the code there.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/docs/security/"
      ],
      "architecture": "server-backed"
    },
    {
      "title": "FastAPI integration",
      "url": "https://auth.bhauu.online/integrations/fastapi/",
      "category": "integration",
      "summary": "Use a server-side transaction store and validate state in the callback.",
      "audience": "developers",
      "related": [
        "https://auth.bhauu.online/docs/getting-started/",
        "https://auth.bhauu.online/docs/security/"
      ],
      "architecture": "server-backed"
    }
  ],
  "educational_content": {
    "title": "Bhauu Auth Blog",
    "url": "https://auth.bhauu.online/blog/",
    "role": "Supplementary educational and explanatory content. Public HTML documentation remains authoritative for integration behavior."
  },
  "oauth": {
    "authorization_endpoint": "https://auth.bhauu.online/oauth/authorize",
    "token_endpoint": "https://auth.bhauu.online/oauth/token",
    "userinfo_endpoint": "https://auth.bhauu.online/oauth/userinfo",
    "revocation_endpoint": "https://auth.bhauu.online/oauth/revoke",
    "introspection_endpoint": "https://auth.bhauu.online/oauth/introspect",
    "jwks_uri": "https://auth.bhauu.online/.well-known/jwks.json",
    "response_type": "code",
    "pkce_method": "S256",
    "documented_scopes": [
      "profile",
      "email"
    ]
  },
  "constraints": {
    "oidc_supported": false,
    "id_token_supported": false,
    "pkce_required": true,
    "redirect_uri_match": "exact",
    "generic_refresh_grant_documented": false,
    "public_client_secret_allowed": false,
    "automatic_application_logout_on_bhauu_revoke": false,
    "agent_guidance": [
      "Prefer linked Bhauu Auth documentation over generic OAuth assumptions.",
      "Do not add OpenID Connect or ID-token logic.",
      "Do not invent endpoints or public scopes.",
      "Preserve PKCE S256, exact redirect matching, and client-side state validation.",
      "Never put a client secret in a browser bundle or mobile binary.",
      "Do not assume a generic refresh-token grant is part of the stable public contract.",
      "Application-owned sessions and data remain the client application's responsibility."
    ]
  },
  "support": {
    "authoritative_docs_url": "https://auth.bhauu.online/docs/",
    "machine_readable_index_url": "https://auth.bhauu.online/llms.txt",
    "registration_url": "https://auth.bhauu.online/login",
    "note": "This manifest is a Bhauu Auth discovery artifact, not an industry standard or a replacement for the public HTML documentation."
  }
}