Point any OIDC library at it. No bespoke code.

• GET/.well-known/openid-configurationDiscovery
• GETPOST/api/v1/oauth/authorizeAuthorization: code flow, PKCE required
• POST/api/v1/oauth/tokenToken
• GETPOST/api/v1/oauth/userinfoUserInfo
• GET/.well-known/jwks.jsonThe keys to verify tokens with
• GET/api/v1/oauth/logoutEnd session
• POST/api/v1/oauth/device_authorizationDevice authorization, for CLI sign-in
• POST/api/v1/oauth/introspectToken introspection
• POST/api/v1/oauth/revokeToken revocation

import { createVerifier, ZynthAuthError } from "@zynth/auth-client";

const verifier = createVerifier({ baseUrl: "https://auth.example.com" });

const claims = await verifier.verify(token);
// claims.sub    the user id (or agent id)
// claims.tid    the tenant
// claims.actor  "agent" for AI-agent principals, absent for humans

# zyn_live_<secret>_<checksum>   (test keys: zyn_test_…)
curl https://auth.zynthmedia.com/api/v1/consent/admin \
  -H "Authorization: Bearer zyn_live_…"

// Zynth-Signature: t=<unix-seconds>,v1=<hex-hmac-sha256>
// signed material: HMAC-SHA256( secret, "<t>.<raw body bytes>" )
const crypto = require("node:crypto");

function verify(header, body, secrets, tolerance = 300) {
  if (!header || secrets.length === 0) return false;
  const fields = {};
  for (const chunk of header.split(",")) {
    const idx = chunk.indexOf("=");
    if (idx <= 0) continue;
    (fields[chunk.slice(0, idx).trim()] ||= []).push(chunk.slice(idx + 1));
  }
  const stamps = fields.t || [];
  const signatures = fields.v1 || [];
  if (stamps.length !== 1 || signatures.length === 0) return false;
  const ts = Number.parseInt(stamps[0], 10);
  if (!Number.isInteger(ts)) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - ts) > tolerance) return false;
  const signed = Buffer.concat([Buffer.from(`${ts}.`), body]);
  return secrets.some((s) => {
    const valid = Buffer.from(crypto.createHmac("sha256", s).update(signed).digest("hex"));
    return signatures.some((c) => {
      const a = Buffer.from(c);
      return a.length === valid.length && crypto.timingSafeEqual(a, valid);
    });
  });
}