Request paths

These are the full transcripts behind the guides: every request a client or a browser makes to the protocol endpoints, and the exact answer that came back. Reach for them when you want every header and every byte rather than the short version.

Each block is a command that was run and the output it printed. Values that change on every run, such as codes, tokens and ids, are shortened where they appear, and the page says so.

How they were captured is in How the transcripts are captured and checked.

Pages

• The shape of it
• Bootstrap
• Path A: authorization code with PKCE
• Path A, as a confidential client
• Self-registration
• Two-factor authentication with TOTP
• Recovery codes
• Enrolling a passkey
• Signing in with a passkey, and no username
• Password reset
• Following a required-actions link
• Password expiry, and changing a password
• Brute-force lockout
• Path B: refresh rotation
• Retention: what odudu reap removes
• Sending queued mail: odudu send-mail
• RP-initiated logout
• Path C: client_credentials
• Path D: token exchange
• CORS: the preflight and the request differ
• One sign-in's audit trail, read through the admin API
• The branches
• The documentation under /docs
• What to do next, from wherever you are