Read identity and discover Auth endpoints
Use ShareAI Auth discovery, JWKS and UserInfo to validate application sign-in and read the identity permitted by an OAuth access token.
On this page
Discover the issuer#
https://auth.shareai.now/.well-known/openid-configurationRead OpenID Connect metadata.
- Base URL
https://auth.shareai.now- Authentication
- No credential
cURL
curl --fail-with-body https://auth.shareai.now/.well-known/openid-configuration
Read the issuer, authorization endpoint, token endpoint, UserInfo endpoint and JWKS URI from discovery. Validate the issuer against your configured ShareAI issuer; do not trust a discovery URL supplied by an arbitrary user.
Read the approved account identity#
https://auth.shareai.now/oauth/userinfoRead claims allowed by the granted scopes.
- Base URL
https://auth.shareai.now- Authentication
- Bearer OAuth access token
- Required scope
openid
cURL
curl --fail-with-body https://auth.shareai.now/oauth/userinfo \
-H "Authorization: Bearer $SHAREAI_ACCESS_TOKEN"
Use sub as an opaque client-specific account identifier. profile and email affect optional claims. Organization authorizations intentionally omit the approving person’s private profile details.
Validate an ID token#
Use a maintained OpenID Connect library. Validate the token signature with the discovered JWKS, the exact issuer, your client ID as audience, expiry and the nonce saved before authorization. Do not accept a decoded JWT as proof until these checks pass.
Other discovery routes#
| Method and path | Purpose |
|---|---|
GET /.well-known/oauth-authorization-server | OAuth authorization-server metadata. |
GET /.well-known/jwks.json | Public signing keys. |
GET /oauth/me | Authenticated account identity endpoint. |
Last updated September 15, 2026