OAuth 2.1
Sweep is both the authorization server and the resource server.
| Endpoint | URL |
|---|---|
| Authorization | https://api.trustysweep.com/oauth/authorize |
| Token | https://api.trustysweep.com/oauth/token |
| Registration (RFC 7591) | https://api.trustysweep.com/oauth/register |
| Revocation | https://api.trustysweep.com/oauth/revoke |
| Introspection | https://api.trustysweep.com/oauth/introspect |
| AS metadata (RFC 8414) | https://api.trustysweep.com/.well-known/oauth-authorization-server |
| Protected resource metadata (RFC 9728) | https://api.trustysweep.com/.well-known/oauth-protected-resource and https://mcp.trustysweep.com/.well-known/oauth-protected-resource/mcp |
| JWKS | https://api.trustysweep.com/.well-known/jwks.json |
Requirements: authorization-code flow with PKCE (S256) only; resource (RFC 8707) is required and access tokens are audience-bound (https://api.trustysweep.com or https://mcp.trustysweep.com/mcp); refresh tokens rotate and reuse revokes the family; access tokens are short-lived. Clients may be registered in the console, dynamically (RFC 7591), or via a Client ID Metadata Document.
The consent screen lists scopes in plain language and, for destructive scopes, requires an explicit step. The user can revoke the client at any time from Account → Connected apps.