OAuth 2.0 authorization support-Alibaba Cloud DevOps(Alibaba Cloud DevOps)-阿里云帮助中心

Alibaba Cloud DevOps act as an OAuth 2.0 authorization server that enables third-party applications to access resources on behalf of authorized users through the authorization code with Proof Key for Code Exchange (PKCE) flow.

Authorization flow overview

Third-party applications use the authorization code flow to obtain access tokens without handling user credentials. The issued access token grants the same resource access permissions as the authorizing user. The following sequence describes how the flow works with Alibaba Cloud DevOps:

Register a client — Use the Dynamic Client Registration (DCR) endpoint to automatically obtain a client_id. No pre-registration or client_secret is required because Alibaba Cloud DevOps supports public clients only.
Request user authorization — Direct the user to the authorization endpoint. After the user logs in and grants authorization, an authorization code is issued.
Exchange the code for tokens — Send the authorization code along with the PKCE code_verifier to the token endpoint. Alibaba Cloud DevOps returns an access token (valid for 24 hours) and a refresh token (valid for 90 days).
Refresh tokens — Before the access token expires, use the refresh token at the token endpoint to obtain a new access token.

Supported capabilities

Capability	Details
Authorization flow	Authorization code flow (`authorization_code`), with `refresh_token` support
Client type	Public client only; `token_endpoint_auth_method` supports `none` only; no `client_secret` is issued
PKCE	Mandatory; `code_challenge_method` supports `S256` only
Dynamic Client Registration (DCR)	Supported; clients automatically receive a `client_id` without requiring pre-registration
Metadata discovery	Supports authorization server metadata discovery and protected resource metadata discovery
Token format	Opaque tokens (non-JSON Web Token (JWT)); access tokens are prefixed with `oat-`, refresh tokens are prefixed with `ort-`
Token lifetime	Access token: 24 hours; refresh token: 90 days

Unsupported capabilities

Capability	Description
Client credentials flow (`client_credentials`)	Machine-to-machine authorization without user involvement is not supported
Resource owner password flow (`password`)	Not supported
Implicit flow (`implicit`)	Not supported
Plain PKCE	Not supported; only `S256` is accepted
Confidential clients / `client_secret`	Not issued or validated
Token introspection endpoint, token revocation endpoint	Not exposed externally
Scope-based permission restriction	Not supported; token permissions are equivalent to those of the authorizing user; `scope` is stored as metadata only

Endpoint reference

Retrieve endpoint URLs through metadata discovery rather than hardcoding them. The authorization endpoint and token endpoint may reside on different domains.

Endpoint	Path	Method	Authentication	Description
Authorization server metadata	`/.well-known/oauth-authorization-server`	GET	Anonymous	Discover endpoint URLs
Protected resource metadata	`/.well-known/oauth-protected-resource`	GET	Anonymous	Retrieve the corresponding authorization server
Dynamic client registration	`/v1/oauth2/register`	POST	Anonymous	Register a client and obtain a `client_id`
Authorization endpoint	`/v1/oauth2/authorize`	GET / POST	User login	User grants authorization; an authorization code is issued
Token endpoint	`/v1/oauth2/token`	POST	Public client (anonymous)	Exchange an authorization code for tokens, or refresh tokens

Authorization server metadata response fields

The /.well-known/oauth-authorization-server endpoint returns the following fields:

Field	Value
`issuer`	Authorization server identifier (varies by site)
`authorization_endpoint`	Authorization endpoint URL (may differ in domain from the token endpoint)
`token_endpoint`	Token endpoint URL
`registration_endpoint`	Dynamic registration endpoint URL
`response_types_supported`	`["code"]`
`grant_types_supported`	`["authorization_code", "refresh_token"]`
`code_challenge_methods_supported`	`["S256"]`
`token_endpoint_auth_methods_supported`	`["none"]`

Note

The metadata response does not include scopes_supported, jwks_uri, introspection_endpoint, or revocation_endpoint. The response includes Cache-Control: public, max-age=3600.

Protected resource metadata response fields

The /.well-known/oauth-protected-resource endpoint returns the following fields:

Field	Description
`resource`	Protected resource identifier
`authorization_servers`	List of authorization server URLs associated with this resource

Sites

The authorization service is provided independently on the Center site and Region sites. The two sites are isolated; client_id values and tokens are not interchangeable across sites.

Site	Service URL
Center site	`https://openapi-rdc.aliyuncs.com`
Region site	Your instance access domain (available in the instance settings in the console)