# Bhauu Auth

Bhauu Auth provides hosted authentication and OAuth authorization for applications using the shared canonical Bhauu Identity. Applications keep their own data and local sessions. This plain-text index is an additional discovery aid, not a standard or a replacement for public HTML docs.

## Canonical documentation
- [Bhauu Auth Documentation](https://auth.bhauu.online/docs/)
- [Getting started](https://auth.bhauu.online/docs/getting-started/)
- [OAuth authorization](https://auth.bhauu.online/docs/oauth/)
- [PKCE S256](https://auth.bhauu.online/docs/pkce/)
- [Redirect URIs](https://auth.bhauu.online/docs/redirect-uris/)
- [Tokens and response fields](https://auth.bhauu.online/docs/tokens/)
- [Sessions and continuity](https://auth.bhauu.online/docs/sessions/)
- [UserInfo](https://auth.bhauu.online/docs/userinfo/)
- [Revocation](https://auth.bhauu.online/docs/revocation/)
- [Token introspection](https://auth.bhauu.online/docs/introspection/)
- [Errors and troubleshooting](https://auth.bhauu.online/docs/errors/)
- [Security guide](https://auth.bhauu.online/docs/security/)
- [Build authentication with Bhauu Auth](https://auth.bhauu.online/developers/)
- [Integration guides](https://auth.bhauu.online/integrations/)

## Integration guides
- [JavaScript integration](https://auth.bhauu.online/integrations/javascript/)
- [TypeScript integration](https://auth.bhauu.online/integrations/typescript/)
- [React integration](https://auth.bhauu.online/integrations/react/)
- [Node.js integration](https://auth.bhauu.online/integrations/nodejs/)
- [Next.js integration](https://auth.bhauu.online/integrations/nextjs/)
- [PHP integration](https://auth.bhauu.online/integrations/php/)
- [Laravel integration](https://auth.bhauu.online/integrations/laravel/)
- [Python integration](https://auth.bhauu.online/integrations/python/)
- [FastAPI integration](https://auth.bhauu.online/integrations/fastapi/)

## Supplementary education
- [Bhauu Auth Blog](https://auth.bhauu.online/blog/) - explanatory articles; the public HTML documentation above remains authoritative for integration behavior.

## Stable OAuth contract
- Authorization Code with required PKCE S256: https://auth.bhauu.online/oauth/authorize
- Code exchange: https://auth.bhauu.online/oauth/token
- Bearer UserInfo: https://auth.bhauu.online/oauth/userinfo
- Revocation: https://auth.bhauu.online/oauth/revoke
- Confidential-backend introspection: https://auth.bhauu.online/oauth/introspect
- Access-token verification keys: https://auth.bhauu.online/.well-known/jwks.json
- Documented public scopes: profile email. Exact registered redirect URI and random state are required.

## Important constraints
- Bhauu Auth is not currently OpenID Connect and does not issue ID tokens. Do not use openid scope or ID-token/OIDC assumptions.
- Do not expose a client_secret in browser code. Generic grant_type=refresh_token guidance is not part of the stable public contract yet.
- Do not assume phone/admin public scopes, official native/mobile SDKs, automatic application-local logout, or deletion of application-owned data.

## Product terminology
- Bhauu: Parent brand.
- Bhauu Identity: Canonical identity shared across Bhauu products and connected applications.
- Bhauu Auth: Hosted authentication and OAuth authorization gateway.
- Bhauu Account: User-facing identity and account control centre.
- Developer Portal: Private application registration and configuration surface.
- Connected App: An application authorized to use a user's Bhauu Identity; it retains its own product data and local sessions.

Machine-readable documentation manifest: https://auth.bhauu.online/docs/manifest.json
Expanded integration context: https://auth.bhauu.online/llms-full.txt