# OAuth API Reference

OAuth 2.0 authorization, token management, and dynamic client registration (RFC 7591/7592)

Version: 1.0.0
License: Proprietary

## Servers

Production
```
https://public.api.iclosed.io
```

Development (use for local integration tests; published specs avoid localhost per lint rules)
```
https://public-dev.api.iclosed.io
```

## Download OpenAPI description

 - [OAuth API Reference](https://developer.iclosed.io/_bundle/openapi/v1/oauth.yaml)

 - [GET /v1/oauth/authorize](https://developer.iclosed.io/openapi/v1/oauth/other/oauthauthorize.md): Backend step after the iClosed consent UI (`https://app.iclosed.io/oauth/authorize`): validates client, redirect URI, and scopes, requires an authenticated resource owner session (Bearer session JWT f
 - [POST /v1/oauth/token](https://developer.iclosed.io/openapi/v1/oauth/other/oauthtoken.md): Exchanges an authorization code for access/refresh tokens (with `code_verifier` when the code was issued with PKCE), or rotates refresh tokens. Supports `authorization_code` and `refresh_token` grants
 - [POST /v1/oauth/revoke](https://developer.iclosed.io/openapi/v1/oauth/other/oauthrevoke.md): Revokes an access token or refresh token. Endpoint is idempotent and always returns 200 for known clients.