Commit 9950c3d

mo <mo@mokhan.ca>
2018-10-28 22:10:34
document the proof key code exchange
main
1 parent c65abd8
Changed files (11)
doc
_includes
get-well-known-oauth-authorization-server.html
oauth-dynamic-client-registration.html
oauth-tokens-authorization-code.html
oauth-tokens-client-credentials.html
oauth-tokens-password.html
oauth-tokens-pkce.html
oauth-tokens-refresh-token.html
oauth-tokens-saml-assertion.html
_posts
2018-10-28-oauth-proof-key-code-exchange.markdown
spec
requests
oauth
tokens_spec.rb
documentation.rb
doc/_includes/get-well-known-oauth-authorization-server.html
@@ -34,7 +34,7 @@ Referrer-Policy: strict-origin-when-cross-origin
 Content-Type: application/json; charset=utf-8
 Etag: W/"7f1eee6ebfc3008c58d630548ed1707c"
 Cache-Control: max-age=0, private, must-revalidate
-X-Request-Id: 5f1ee7c9-fd72-4d91-b27f-4a18f47551a4
+X-Request-Id: 65841757-6a8a-42b0-925c-e06cdad37824
 Transfer-Encoding: chunked
 ```
doc/_includes/oauth-dynamic-client-registration.html
@@ -6,7 +6,7 @@ Example curl request:
 ```bash
 $ curl http://localhost:5000/oauth/clients \
   -X POST \
-  -d '{"redirect_uris":["https://rosenbaum.info","https://harberritchie.co.uk"],"client_name":"Gayle Lindgren","token_endpoint_auth_method":"client_secret_basic","logo_uri":"https://zulaufmurray.name","jwks_uri":"https://gulgowskischowalter.biz"}' \
+  -d '{"redirect_uris":["https://marvindamore.biz","https://damore.com"],"client_name":"Yesenia Tromp","token_endpoint_auth_method":"client_secret_basic","logo_uri":"https://dare.com","jwks_uri":"https://hauckkessler.name"}' \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
@@ -26,13 +26,13 @@ Request Body:
 ```json
 {
   "redirect_uris": [
-    "https://rosenbaum.info",
-    "https://harberritchie.co.uk"
+    "https://marvindamore.biz",
+    "https://damore.com"
   ],
-  "client_name": "Gayle Lindgren",
+  "client_name": "Yesenia Tromp",
   "token_endpoint_auth_method": "client_secret_basic",
-  "logo_uri": "https://zulaufmurray.name",
-  "jwks_uri": "https://gulgowskischowalter.biz"
+  "logo_uri": "https://dare.com",
+  "jwks_uri": "https://hauckkessler.name"
 }
 ```
 
@@ -48,8 +48,8 @@ Referrer-Policy: strict-origin-when-cross-origin
 Cache-Control: no-cache, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-Set-Cookie: _proof=a8764373d180a5ecccce3cce31a4f64d; path=/; HttpOnly
-X-Request-Id: e165ef5e-14d7-41f2-b4e4-cbc48c489daf
+Set-Cookie: _proof=34ce358055bd100dbc97cc9d32b1e77c; path=/; HttpOnly
+X-Request-Id: 4ad9810e-4d3e-431f-b2a2-7b46568db8a3
 Transfer-Encoding: chunked
 ```
 
@@ -57,13 +57,13 @@ Transfer-Encoding: chunked
 Response Body:
 ```json
 {
-  "client_id": "cdb39a8b-71bc-4687-8849-d438c039aece",
-  "client_secret": "J6q9bdMuhWuGjuY4w7VFhDgs",
-  "client_id_issued_at": 1540763754,
+  "client_id": "7afbb5ea-bdb9-46e4-8215-22998985798d",
+  "client_secret": "Jxkd5n1fr2y3pLP8zQXpafdd",
+  "client_id_issued_at": 1540764526,
   "client_secret_expires_at": 0,
   "redirect_uris": [
-    "https://rosenbaum.info",
-    "https://harberritchie.co.uk"
+    "https://marvindamore.biz",
+    "https://damore.com"
   ],
   "grant_types": [
     "authorization_code",
@@ -72,10 +72,10 @@ Response Body:
     "password",
     "urn:ietf:params:oauth:grant-type:saml2-bearer"
   ],
-  "client_name": "Gayle Lindgren",
+  "client_name": "Yesenia Tromp",
   "token_endpoint_auth_method": "client_secret_basic",
-  "logo_uri": "https://zulaufmurray.name",
-  "jwks_uri": "https://gulgowskischowalter.biz"
+  "logo_uri": "https://dare.com",
+  "jwks_uri": "https://hauckkessler.name"
 }
 ```
doc/_includes/oauth-tokens-authorization-code.html
@@ -6,11 +6,11 @@ Example curl request:
 ```bash
 $ curl http://localhost:5000/oauth/tokens \
   -X POST \
-  -d '{"grant_type":"authorization_code","code":"3cKqLL1A6zHw4EJbS8GCPV9g"}' \
+  -d '{"grant_type":"authorization_code","code":"azrFtvUHUUrrk1N31njRjjhd"}' \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
-  -H "Authorization: Basic MjEzYmJiZmUtNThiZi00NTQ0LWJkOWEtY2ViOTVmNjM5NTAyOmtITERpNllyYWt3Rnk0R2RINFRreGF0cg==" \
+  -H "Authorization: Basic MTRhMmY1ZDUtOTQ1OS00N2U2LWJhMjQtZjdmYWYyZjIzZjFkOm9qRU5yRDQxb3ZMeUF4Uk45WEFvTWVRYw==" \
   -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
 ```
 Request Headers:
@@ -19,7 +19,7 @@ Request Headers:
 Accept: application/json
 Content-Type: application/json
 User-Agent: net/hippie 0.1.9
-Authorization: Basic MjEzYmJiZmUtNThiZi00NTQ0LWJkOWEtY2ViOTVmNjM5NTAyOmtITERpNllyYWt3Rnk0R2RINFRreGF0cg==
+Authorization: Basic MTRhMmY1ZDUtOTQ1OS00N2U2LWJhMjQtZjdmYWYyZjIzZjFkOm9qRU5yRDQxb3ZMeUF4Uk45WEFvTWVRYw==
 Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```
 
@@ -28,7 +28,7 @@ Request Body:
 ```json
 {
   "grant_type": "authorization_code",
-  "code": "3cKqLL1A6zHw4EJbS8GCPV9g"
+  "code": "azrFtvUHUUrrk1N31njRjjhd"
 }
 ```
 
@@ -44,9 +44,9 @@ Referrer-Policy: strict-origin-when-cross-origin
 Cache-Control: private, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-Etag: W/"97f278c892b79b77c82e1d3d30808b7a"
-Set-Cookie: _proof=b9ebc968a2ccbbe921d90d25fcbcea09; path=/; HttpOnly
-X-Request-Id: d512efc6-050b-428b-a633-d504b88dd45b
+Etag: W/"4f0af7aea9d0d35cd414ce197b2dc0bc"
+Set-Cookie: _proof=6283dc6270180381207e33de8c798095; path=/; HttpOnly
+X-Request-Id: 4c22a70a-02c7-4bbd-b379-de3ab0ef1e2b
 Transfer-Encoding: chunked
 ```
 
@@ -54,10 +54,10 @@ Transfer-Encoding: chunked
 Response Body:
 ```json
 {
-  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjczNTMsImlhdCI6MTU0MDc2Mzc1MywiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjM3NTMsImF1ZCI6IjIxM2JiYmZlLTU4YmYtNDU0NC1iZDlhLWNlYjk1ZjYzOTUwMiIsImp0aSI6IjIzMDVlNWMzLTg3MzUtNGJkZS1iYTIwLTNmMWMwMTQ0YWRhNSIsInN1YiI6IjdkZWE1MDBjLTIwYTItNGQyMy1hOWY3LTk2MzEyNDQ2ZGEwZSIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.JBl81fiZGPJ8CdYEVsFL0Hwdso8_pqyckk6sMpqq_WbH5AdvKuY-Ra8oFufY-Fa2pfT-Eh1bfSJhBUDg2sTO9AwN5EUEMd68YI314LaMQssbJspOEfeyvO97d0BwOQ2HWRUdEosFf840gFtDpue-cIJMmtTvIAe_87bwvgsbvcJYqjyZhq97ztPI1hQ49-RoRAc_A3qz0ZBntsdbmgWhWvYzMiSZMjLSEoAejsw9JSOjhpQtNgH0jxKDFfmTlDyh9DY54GG2BYTyb1m4JdLg2jTP1zv6JnHctzWN6YSStniqRjSaavCcI9FkRLLSLBPr11NvvpmIqsBNXCgn9OOVhQ",
+  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjgxMjUsImlhdCI6MTU0MDc2NDUyNSwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjQ1MjUsImF1ZCI6IjE0YTJmNWQ1LTk0NTktNDdlNi1iYTI0LWY3ZmFmMmYyM2YxZCIsImp0aSI6IjdjM2E4Y2NiLWI5M2YtNDJhNC04ZDEyLTIyMTc0NmQzYzg5ZiIsInN1YiI6Ijk0YTQ1MzQ0LTNhNDItNGEzZi1hNmM5LTBlMGVhZDU5NTMzZCIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.Uv7QDl7i_cmEXZK4BwM-AInpxuPaQh2WS2BbEEQItRdysQY6WdUSNCuv6mWmmDHcnG_mceL7pZTyidrJ4_7rVekz-u1ZoWXPrayE9RcX5vM8Yzlubl4QAbKXYQlVWFbbNDxj9egxoUvDsqZ4tPYtE2vZ4TQ6Mz4Xs4Kok1oTdcZN8ANsjoYuTspTioYprRggXkPepuNFLR4IVi8PWtzNP-nTMc9eFjbrQLEn5j2gUoYOqFJAXx2TmhdNAzV0dTzfLF9xkgRCKEoCJ-4C7h7CR2dqIe_4sKc9NuswSKK1SV_CdrYD3bFTx4j91MtGeICmAyLPkFS-eV4zog36uvy--Q",
   "token_type": "Bearer",
   "expires_in": 3600,
-  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4NTAxNTMsImlhdCI6MTU0MDc2Mzc1MywiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjM3NTMsImF1ZCI6IjIxM2JiYmZlLTU4YmYtNDU0NC1iZDlhLWNlYjk1ZjYzOTUwMiIsImp0aSI6IjliNDc1NDg1LWQwYzMtNDRiNC1hMTcwLTBjYzNmNTE2MWNmNiIsInN1YiI6IjdkZWE1MDBjLTIwYTItNGQyMy1hOWY3LTk2MzEyNDQ2ZGEwZSIsInRva2VuX3R5cGUiOiJyZWZyZXNoIn0.cFcYvk8P69jstyHHMppRa7q-FD31RF10csSBF5-7yJrXSGZPkS1xsP2ZGXT7dYW2D1Wf8bK1blZUdEkzGRNY5bFLpJpZMXkiJ-9SY5kNyj8Eo7OTovZtivF_SZ4XeFFEBzyJJeFaaUyEOayHL-bCtGm5zbOFPZk3ESZK6wHtFkAbNgVjsbgM81kXRcpQxQUBNfov85tGKoiOP4KSnJuEyhPlfMs70JBAE7CRz-pmg_tjIMwlM4Qim6AgBtqNwJaLP-ygZBYtkm1Y0xbzL7q0J0G_kstm26RHQriYyJub1EpKMvFMRk33z7hpWllmdyYNpkpD39nnRC31sYBchhAZpA"
+  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4NTA5MjUsImlhdCI6MTU0MDc2NDUyNSwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjQ1MjUsImF1ZCI6IjE0YTJmNWQ1LTk0NTktNDdlNi1iYTI0LWY3ZmFmMmYyM2YxZCIsImp0aSI6Ijc2MmY3OGVhLTQyZDAtNDI2ZC05ZjdlLTYwYjcyM2RiN2UzMCIsInN1YiI6Ijk0YTQ1MzQ0LTNhNDItNGEzZi1hNmM5LTBlMGVhZDU5NTMzZCIsInRva2VuX3R5cGUiOiJyZWZyZXNoIn0.gmRtKrSncC3-jdfZJ0xXNfvhqqNVAGP_9FIO4mtuBJ5nbL9EMgr6kYnWRgzots1JPhzQ0vvWlIdkMQxU8iELlgBk8UZFmJTgUvEEoKp1Zrf-Pxqb_BgH9n5qS6yS1SiZ3LI7BHhAchKvs8e-lRz1PkU_PM5YisYHPy89Qxb24wyBSuo-jdWpUKhzSuiXzvV0DjxYgXpxbKLUA05bnZ2gGVbcm-ncqHx9Gb1I4FZnwa4VdwRY8s_aNfD1y0YnVyYun3fiqXexYSW5YTQF-iXustguTa-oJniDZX4yJQy_Xs11czsT2NAx02p7RRJK32SoOMMXZYVZzd35JBBcYBP21w"
 }
 ```
doc/_includes/oauth-tokens-client-credentials.html
@@ -10,7 +10,7 @@ $ curl http://localhost:5000/oauth/tokens \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
-  -H "Authorization: Basic MDk4NjNlYWItNjJiNi00ZmMwLWJhNzgtMmYzMjY1OWEwZGUyOmNZWTZMa1l4QkprM2U4bTExNjRxYm1NNw==" \
+  -H "Authorization: Basic YTY0MjBhMTktYWJmMS00N2JiLTgzODctNGQ5YjFiMjMxMmFmOkdOZUQzYlRoYjRZbXVmWnFyWW9RRHdKNA==" \
   -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
 ```
 Request Headers:
@@ -19,7 +19,7 @@ Request Headers:
 Accept: application/json
 Content-Type: application/json
 User-Agent: net/hippie 0.1.9
-Authorization: Basic MDk4NjNlYWItNjJiNi00ZmMwLWJhNzgtMmYzMjY1OWEwZGUyOmNZWTZMa1l4QkprM2U4bTExNjRxYm1NNw==
+Authorization: Basic YTY0MjBhMTktYWJmMS00N2JiLTgzODctNGQ5YjFiMjMxMmFmOkdOZUQzYlRoYjRZbXVmWnFyWW9RRHdKNA==
 Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```
 
@@ -43,9 +43,9 @@ Referrer-Policy: strict-origin-when-cross-origin
 Cache-Control: private, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-Etag: W/"d8306b751703a2d0a409893ec0a7454b"
-Set-Cookie: _proof=e2df7b00252f44391f1fb25ed7d16df6; path=/; HttpOnly
-X-Request-Id: d60a27e0-d5cf-42ad-b889-d223cb2d90b9
+Etag: W/"e3215160e66f0ab969f099996c5bb9a2"
+Set-Cookie: _proof=a7a673cebd402aa0597071d8511ef6b0; path=/; HttpOnly
+X-Request-Id: d7764795-4baa-43f4-9855-618e2da2880d
 Transfer-Encoding: chunked
 ```
 
@@ -53,7 +53,7 @@ Transfer-Encoding: chunked
 Response Body:
 ```json
 {
-  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjczNTQsImlhdCI6MTU0MDc2Mzc1NCwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjM3NTQsImF1ZCI6IjA5ODYzZWFiLTYyYjYtNGZjMC1iYTc4LTJmMzI2NTlhMGRlMiIsImp0aSI6ImMyNjE1OTZhLTUyMTUtNDY0MS1hY2U1LWU4N2YxYzhkZDBhMyIsInN1YiI6IjA5ODYzZWFiLTYyYjYtNGZjMC1iYTc4LTJmMzI2NTlhMGRlMiIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.c7kPd6vUyBc4jen8wSzNgMNCeFd92LPbQgGVcjOIn8v8UM6zGCrHHCtaPWX9xopc1kBiPOvorwKYzFYTgIR9iN75dY2sOIWL0I9QaURf0a8W5CcrrhE_wySfVVUxaYBM1d4O9vAkFMYHuyFef_lMwrlGSkSBViQHnZt7nq39HglG1tKLeVDnM95-lv9aQ30TC2E-ahHrT9IR6IyXOp86ttrUbR-0_Y9ee55Iy9jOih15K1IKk2s0cJx0Pziir9nntjBqeiMLKANxc2HCRRb9vQtRDcbV8k2TxyP-45j7KhasPqrlw_nmwkX5SOAdzipADoxT-gE4TF8JU-M4jDnXXA",
+  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjgxMjYsImlhdCI6MTU0MDc2NDUyNiwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjQ1MjYsImF1ZCI6ImE2NDIwYTE5LWFiZjEtNDdiYi04Mzg3LTRkOWIxYjIzMTJhZiIsImp0aSI6ImVkMmUzY2YyLTRiYTYtNDQ2Yi1hY2NjLTQ0YWU4MTc1N2RiZSIsInN1YiI6ImE2NDIwYTE5LWFiZjEtNDdiYi04Mzg3LTRkOWIxYjIzMTJhZiIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.Z3DhRlUxrPQuTflZfFpURUPNyhlu3udWMovt1_5Vpuk4ZSE2gMj9-YlSVF6xRaBPknlqiUaYoEhwPuGxEVBQ_H9eY_VDbGdV_HBDBxrMKfLvH7AhVaEFtmjymfJMUtwk2NZnDRjBnzTNkrDZKR1XTggp2Nb1CCe_1Mb5-8yQX83OQ3jtXQAH0Y4PL0txvvhurGW92k5VqfaHKwGvzFeYYuTDw14JfZlT54L726NZdCZlhq3nCQ4sDGys6FCzZfpMoBoAzaJzXVb4yZX4MSQLSDSuG4_sgFoJkNcl-s-jap6feMPdAkFYwb55VkMTCyohh9gMbKXdldloIuClbRAtRg",
   "token_type": "Bearer",
   "expires_in": 3600
 }
doc/_includes/oauth-tokens-password.html
@@ -6,11 +6,11 @@ Example curl request:
 ```bash
 $ curl http://localhost:5000/oauth/tokens \
   -X POST \
-  -d '{"grant_type":"password","username":"angelica@johnson.co.uk","password":"AppuTs4iS"}' \
+  -d '{"grant_type":"password","username":"michaele@mosciski.info","password":"pOhORXUyBktp"}' \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
-  -H "Authorization: Basic NzZjNmRiYzYtNGU5MC00NDc1LWFhYWQtY2RiNmQ1ZGUwZDVhOmpYeUpTU3RLc2Z5TVg4czFhUEd6V3ZhWg==" \
+  -H "Authorization: Basic NjVmZWM0NGItYjEyMi00ZjYxLWEyY2MtMWU4ODhiYzE0Y2E5OkFrM0JETXBOMW44WFdGMlJua0Y0TlVzNg==" \
   -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
 ```
 Request Headers:
@@ -19,7 +19,7 @@ Request Headers:
 Accept: application/json
 Content-Type: application/json
 User-Agent: net/hippie 0.1.9
-Authorization: Basic NzZjNmRiYzYtNGU5MC00NDc1LWFhYWQtY2RiNmQ1ZGUwZDVhOmpYeUpTU3RLc2Z5TVg4czFhUEd6V3ZhWg==
+Authorization: Basic NjVmZWM0NGItYjEyMi00ZjYxLWEyY2MtMWU4ODhiYzE0Y2E5OkFrM0JETXBOMW44WFdGMlJua0Y0TlVzNg==
 Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```
 
@@ -28,8 +28,8 @@ Request Body:
 ```json
 {
   "grant_type": "password",
-  "username": "angelica@johnson.co.uk",
-  "password": "AppuTs4iS"
+  "username": "michaele@mosciski.info",
+  "password": "pOhORXUyBktp"
 }
 ```
 
@@ -45,9 +45,9 @@ Referrer-Policy: strict-origin-when-cross-origin
 Cache-Control: private, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-Etag: W/"b59d675e5ebf49b365d4437c34fdf7b3"
-Set-Cookie: _proof=72fdf98c6f5c56194e087e29bd52dc0a; path=/; HttpOnly
-X-Request-Id: e91c5611-bd78-477d-a3a9-3d4ae27aacdd
+Etag: W/"b2858b712de9d4e377a1b8e7f90e961a"
+Set-Cookie: _proof=d8e94a8bc095ec2823a022ce66d7d448; path=/; HttpOnly
+X-Request-Id: b6111fd2-2f7f-4397-9c4d-619c5fc98231
 Transfer-Encoding: chunked
 ```
 
@@ -55,10 +55,10 @@ Transfer-Encoding: chunked
 Response Body:
 ```json
 {
-  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjczNTMsImlhdCI6MTU0MDc2Mzc1MywiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjM3NTMsImF1ZCI6Ijc2YzZkYmM2LTRlOTAtNDQ3NS1hYWFkLWNkYjZkNWRlMGQ1YSIsImp0aSI6ImVjMDI3Zjg0LTIxYjgtNGY2Yi05ZjNkLWMxNWZmYThmMWM1ZCIsInN1YiI6ImRiNmFmZjRlLTc2MTYtNGY4MS05ZjY3LTJlMGFlMzAyYzk0MiIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.VQh2YKiCOYC2wJAaex8GjH6watD7p1dtk_l8uH94y-LBppBkj4MhbFPm73bKcrXvgTbS-JdoS2WF5l9gKPGh1pTIhucVLlHiauKGqcEHmGO0RrfHG5K7OldptRiG71C82T5bZjIBBzppRLd3rjFMhyeZ19ATfDp63Aj9xiGzI__UrNwqcM_dpRzsLaSBvWlp77YvVFVbRkTZgr7_t0FlZwjYIurW0IRGz_yL128ESRIQY3TlD3Ik0YMxhYEW_-RSz8kY908oCA_oo-yf02JOt8IO2f7U_8nuM02SJ7akkxwLxR2moj34XRXlslSEnJMbF7LtEU15zDkiOceGxBjLZw",
+  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjgxMjUsImlhdCI6MTU0MDc2NDUyNSwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjQ1MjUsImF1ZCI6IjY1ZmVjNDRiLWIxMjItNGY2MS1hMmNjLTFlODg4YmMxNGNhOSIsImp0aSI6ImE3ODM0M2RiLTJhZmItNDdmNi04NGNhLTRiMTI2OTc0ZTI2NCIsInN1YiI6IjMyM2RjZGNmLWJkMjgtNDBlYi04NjU5LTZkYTQ4MzU4ZmUwNCIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.BtN_4OwokxviwuFTxKT7WZJYWEN6Tej01C2ejCVkWyb9fbQDoiRW8Z7W1sLHD6D5VrR013WDsxXc0mI0HaBSif_n23yyWbscdJFdjcKp8GUa7jKVV4VmhwJuHLtiEf_sTn4vRaDh4GwWZxklD2x_fv3_dQijud7wDSxtr_u6AkeMDRSp9-gv5FZnAmQnWH2P9iIy03dAlvqMKIGd6cFETbBlVwwaHxMwWDFfDAsu9YR2smf7JQofxGcKlfWfegvXklMP1YS8JiMhUrQqFXvzcSXyE_K0d76SthNw0gqnUs8x9PZ_VGorm9MU19YChfcN0RgotrOcRwPcuItFnqgSeA",
   "token_type": "Bearer",
   "expires_in": 3600,
-  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4NTAxNTMsImlhdCI6MTU0MDc2Mzc1MywiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjM3NTMsImF1ZCI6Ijc2YzZkYmM2LTRlOTAtNDQ3NS1hYWFkLWNkYjZkNWRlMGQ1YSIsImp0aSI6IjRmZGI3NDAzLTBlMmYtNGRiYS1iODYxLTAwYzRmYjZlYzIxOSIsInN1YiI6ImRiNmFmZjRlLTc2MTYtNGY4MS05ZjY3LTJlMGFlMzAyYzk0MiIsInRva2VuX3R5cGUiOiJyZWZyZXNoIn0.oEqarqcTPDXyZDbJgdEGMnYXOs0f8CrNpUrR99o7vooQ9BMht802MrzQ-AhASS4zxaHyYEvr8ldjw4af1mks-tf15HhB21A7GQv6K51iYsirtbxVKMcI8X-J_iwlaBspxwa6ADd497ZTUzmAUg9qPSY8Aunf4l3VprMBbQ9wvhwtmiFowRgWCguEt3x7YsC9PCeGLDYOUnRifg3_btAqcrdH7xoLpk4mSHDys6lR2HY6xFGSbfa_y8kF13LHemOSpJWXcdTSImGgVusEpxfaIh_p7A_3yeKLAkl0RF78yH66UoeDvNkpQBU5YvqWLC27cc--kixvnUj21qnXZhYNKA"
+  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4NTA5MjUsImlhdCI6MTU0MDc2NDUyNSwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjQ1MjUsImF1ZCI6IjY1ZmVjNDRiLWIxMjItNGY2MS1hMmNjLTFlODg4YmMxNGNhOSIsImp0aSI6IjRkNjNlZDBhLWYwZWItNGU0MS05ZDFlLTE2MWZhMzA5MTM4MCIsInN1YiI6IjMyM2RjZGNmLWJkMjgtNDBlYi04NjU5LTZkYTQ4MzU4ZmUwNCIsInRva2VuX3R5cGUiOiJyZWZyZXNoIn0.Zmm5WddS4i1DnniQXOvnHYvpGYszTCss4LmR5kYX17HLqpwSkCXbuz-3SPn6OoDYuNlnVqRH9FFt2pN6dv2FQqAJb25Ju4nQbuMhO0MyDZSA6-H8xpWvi9SQ4Qw3eZCaw0DlsUl4_goUmbfFmO0uMZjcp_rDtQzKpjgVEYHNcE7lPJrytR6XPiZgzrxfHXGxudBMXTs24DWuW6t0I7l3jVr5LrKkb8SYjHpWawPKgGoBG13n0Y56_uAVrJFCw7BW69pEnXVIYFecs7UYZiO0_CzjKqraUoNh5hcsm3vJXVk6bL6m-e16EO6ZRqZuL66zRYqL6RHQUEVF8RAHRL4fog"
 }
 ```
doc/_includes/oauth-tokens-pkce.html
@@ -0,0 +1,65 @@
+
+#### POST http://localhost:5000/oauth/tokens
+
+Example curl request:
+
+```bash
+$ curl http://localhost:5000/oauth/tokens \
+  -X POST \
+  -d '{"grant_type":"authorization_code","code":"sFkwD8Ca3FGcwyiMAZrJkAa3","code_verifier":"70bd488699bf3dea8dd22a59e929cbabf24aff07876e9ce45cdbef094c71c23bf7bf69031785d548255d69e312fdf396a7f272b50e06b05720ca482cb427cb43c9a3eded21b4c41994f368d74bdd910d94bb42f9ade19a0c18a312e88ab2240aef885015b4c5464712030ac18aa91106a42ea08ee89d150a0168a7cc41510322"}' \
+  -H "Accept: application/json" \
+  -H "Content-Type: application/json" \
+  -H "User-Agent: net/hippie 0.1.9" \
+  -H "Authorization: Basic ZDdiNTQzNDgtMzAwMC00ZjQ2LWFjOGUtZGYyODU2YWQ4ZTYzOjdVTTNnUTYyQ1NmODQ5Q00xbTlYb0czRQ==" \
+  -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
+```
+Request Headers:
+
+```text
+Accept: application/json
+Content-Type: application/json
+User-Agent: net/hippie 0.1.9
+Authorization: Basic ZDdiNTQzNDgtMzAwMC00ZjQ2LWFjOGUtZGYyODU2YWQ4ZTYzOjdVTTNnUTYyQ1NmODQ5Q00xbTlYb0czRQ==
+Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
+```
+
+
+Request Body:
+```json
+{
+  "grant_type": "authorization_code",
+  "code": "sFkwD8Ca3FGcwyiMAZrJkAa3",
+  "code_verifier": "70bd488699bf3dea8dd22a59e929cbabf24aff07876e9ce45cdbef094c71c23bf7bf69031785d548255d69e312fdf396a7f272b50e06b05720ca482cb427cb43c9a3eded21b4c41994f368d74bdd910d94bb42f9ade19a0c18a312e88ab2240aef885015b4c5464712030ac18aa91106a42ea08ee89d150a0168a7cc41510322"
+}
+```
+
+Response Headers:
+
+```text
+X-Frame-Options: SAMEORIGIN
+X-Xss-Protection: 1; mode=block
+X-Content-Type-Options: nosniff
+X-Download-Options: noopen
+X-Permitted-Cross-Domain-Policies: none
+Referrer-Policy: strict-origin-when-cross-origin
+Cache-Control: private, no-store
+Pragma: no-cache
+Content-Type: application/json; charset=utf-8
+Etag: W/"6f657fc8b7cfd8594899a910156579de"
+Set-Cookie: _proof=7a303e5613a90e32dd16f75a6750dd01; path=/; HttpOnly
+X-Request-Id: 16dbc62a-7a5f-422f-b1d1-11e1e3190b0e
+Transfer-Encoding: chunked
+```
+
+
+Response Body:
+```json
+{
+  "access_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjgxMjcsImlhdCI6MTU0MDc2NDUyNywiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjQ1MjcsImF1ZCI6ImQ3YjU0MzQ4LTMwMDAtNGY0Ni1hYzhlLWRmMjg1NmFkOGU2MyIsImp0aSI6ImRhMjljYTI1LWJhMDItNGQzMy05ODUwLTcxN2U2MmM2YzhhYiIsInN1YiI6IjBmMDkzZmM1LWU0ZDUtNDU3My04YzU1LTBhMzg3Y2Y5YTdkNiIsInRva2VuX3R5cGUiOiJhY2Nlc3MifQ.LTEgilCVyP_X7IvxUrRttetoUTWo5qHEbmv-dtXtwBdWHcz6gT1unHgy5WZL_2fabg9qakWo8nxVkYErW0LU_FktjK3Y_NRy3wp7AgZ8GG2oiwSpp8o-Ohjnwq60qvtXQHbUmiQ-7MGV-t-ZtOcftLc8mEs0MadA-Rss4NtFc-amp9Y_eYAxWeb_DQK_jEJc3NcZjIcCZH0EtwmqE9xPVIG8VowVyrBvqJ8Q9SQpM1r6dGvWoB5icOT-hBu0aLF3BCuv7jVH2uHVD9SkETfjvu-S2gtlndQnUl1fZ-4R29QkBaOpvydt9pqWjEf7VaJgtSSmiWm2B7RBqxxq1B_YVg",
+  "token_type": "Bearer",
+  "expires_in": 3600,
+  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA4NTA5MjcsImlhdCI6MTU0MDc2NDUyNywiaXNzIjoiaHR0cDovL3Byb29mLnRlc3QvbWV0YWRhdGEiLCJuYmYiOjE1NDA3NjQ1MjcsImF1ZCI6ImQ3YjU0MzQ4LTMwMDAtNGY0Ni1hYzhlLWRmMjg1NmFkOGU2MyIsImp0aSI6ImM4N2Y4MzYwLWM0YWEtNDI1ZC1hZTljLTJmNzIyN2E4N2RiNSIsInN1YiI6IjBmMDkzZmM1LWU0ZDUtNDU3My04YzU1LTBhMzg3Y2Y5YTdkNiIsInRva2VuX3R5cGUiOiJyZWZyZXNoIn0.keyn8te4hncqpqQI43vTshO4_vd4NDX8GJ0pDviNmFnSMyDfFsQ_kQ_mjTFns_T6K63YfW-x_3W02fH6V8ucRWQezj0xItUC7UYuFi9K6BozgQKy92RfyDdjvU0MWTXpK7_r-NnuaRTe0Ud7FXCdMfrDCDgbNMNIyA9FsYUR7UeDgKKQHHatI2WEiN2YRVUjWeaD4a2w_EDyqu_gkElCua3drI282E2PfmMDqPs5znRCTyOTD8JFg1xyJ28--5dMhHRjmb-PD8fnzFReq-74VzL9WVvzDeGUhsZAYgXT0TRAMpT5yPXdscwwesvAfgZnBfdgQPtoQ66QVgEBxVl4iA"
+}
+```
+
+
doc/_includes/oauth-tokens-refresh-token.html
@@ -6,11 +6,11 @@ Example curl request:
 ```bash
 $ curl http://localhost:5000/oauth/tokens \
   -X POST \
-  -d '{"grant_type":"refresh_token","refresh_token":"eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjczNTQsImlhdCI6MTU0MDc2Mzc1NCwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3Q6NTAwMC9tZXRhZGF0YSIsIm5iZiI6MTU0MDc2Mzc1NCwiYXVkIjoiNDRkOTkwZDYtODMwMS00YWU5LTkwYzEtMzc2YzAzYThhYTVlIiwianRpIjoiZDNhMTY2OWMtNmMyNC00MDQ2LTliZGQtMWMyZDE3YzBhNTQ5Iiwic3ViIjoiNzcyOTliNjItMWI0MC00MGY1LTkzYTktZjc3Nzg3ZjQ3M2IxIiwidG9rZW5fdHlwZSI6InJlZnJlc2gifQ.eoRSeivC8MvwrRrF-0mzCwAP07W92VdF336nmp6lIpBqsWUfYYQ9t-xS7xmgGIh6cU_EA3hbJ1eEk-KHe8X8CXKG1FESq9YnNzvMyEAfsS9dppr6JhRgkCknXYyWfk48DZZSn8hNipBaBOUeXQAxF-X6HFX1tW50JFSbEppCt3BU81Z8AY73qm3Y1Gl9X-JYmJcxHg91r5vK1XaxDkW-yZ_zSpLeT4vrQR7Le4r34aQqsZBwSsgcpofZot3LX8h3apgwkOEYSXYHAqTwljPocXSvDQeN7x3fjaNkjr8dAvnFP9rdr7FsfwHmpTIl4xfdihCrqfQxMGZmlM9B6pS_MQ"}' \
+  -d '{"grant_type":"refresh_token","refresh_token":"eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjgxMjYsImlhdCI6MTU0MDc2NDUyNiwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3Q6NTAwMC9tZXRhZGF0YSIsIm5iZiI6MTU0MDc2NDUyNiwiYXVkIjoiMjE3NzVhNTYtOWY3MC00NWEzLThkYTYtOTEzMGEzMzZkODAyIiwianRpIjoiYjQ2YTdiMjktYjRmZC00Zjc2LThkZWUtYzE0MGI5M2MzMGQ2Iiwic3ViIjoiN2M4NWVjNmEtNTA4Zi00ODk2LTg3YjAtNDIyZmRiYjNlYjljIiwidG9rZW5fdHlwZSI6InJlZnJlc2gifQ.SJGc3JnKZjBlaInwwUW5Cmi9zTy7cXVb9-vUaACSqp9w-38KfgUIlYQcwz6BCboxVSSJ1I6nULjffCwPZXWAgMvCsN7OwBSA0MDAjzE9HWMLIc2rmpaqu15EckY75vfR3_xTLRUROGcwcyVsOiwbnUPHCNS9NwA6YrG_c7Ik_AxfhxJTmcN6gmdA6hPcMDTYXAzTOjINcFnTVQd_6IuSUc66NgXXs6R14mrlAHby1-3u8nTJINVl8VzPYBGiv6jHwsi6rn2thshNdqPKqHmxi6ilwdTswbVCYSDYufz2yoKoowRfg_Men1fji3kIIKfjkoRMjzr-0raSPJ7Tamrnvw"}' \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
-  -H "Authorization: Basic NDRkOTkwZDYtODMwMS00YWU5LTkwYzEtMzc2YzAzYThhYTVlOmhUb1BZampEajRWcjJGazhzQ1pIYXJNNw==" \
+  -H "Authorization: Basic MjE3NzVhNTYtOWY3MC00NWEzLThkYTYtOTEzMGEzMzZkODAyOnAzZDQ3Mmh3ZkoyREsyN2hXQmllY244Zw==" \
   -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
 ```
 Request Headers:
@@ -19,7 +19,7 @@ Request Headers:
 Accept: application/json
 Content-Type: application/json
 User-Agent: net/hippie 0.1.9
-Authorization: Basic NDRkOTkwZDYtODMwMS00YWU5LTkwYzEtMzc2YzAzYThhYTVlOmhUb1BZampEajRWcjJGazhzQ1pIYXJNNw==
+Authorization: Basic MjE3NzVhNTYtOWY3MC00NWEzLThkYTYtOTEzMGEzMzZkODAyOnAzZDQ3Mmh3ZkoyREsyN2hXQmllY244Zw==
 Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```
 
@@ -28,7 +28,7 @@ Request Body:
 ```json
 {
   "grant_type": "refresh_token",
-  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjczNTQsImlhdCI6MTU0MDc2Mzc1NCwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3Q6NTAwMC9tZXRhZGF0YSIsIm5iZiI6MTU0MDc2Mzc1NCwiYXVkIjoiNDRkOTkwZDYtODMwMS00YWU5LTkwYzEtMzc2YzAzYThhYTVlIiwianRpIjoiZDNhMTY2OWMtNmMyNC00MDQ2LTliZGQtMWMyZDE3YzBhNTQ5Iiwic3ViIjoiNzcyOTliNjItMWI0MC00MGY1LTkzYTktZjc3Nzg3ZjQ3M2IxIiwidG9rZW5fdHlwZSI6InJlZnJlc2gifQ.eoRSeivC8MvwrRrF-0mzCwAP07W92VdF336nmp6lIpBqsWUfYYQ9t-xS7xmgGIh6cU_EA3hbJ1eEk-KHe8X8CXKG1FESq9YnNzvMyEAfsS9dppr6JhRgkCknXYyWfk48DZZSn8hNipBaBOUeXQAxF-X6HFX1tW50JFSbEppCt3BU81Z8AY73qm3Y1Gl9X-JYmJcxHg91r5vK1XaxDkW-yZ_zSpLeT4vrQR7Le4r34aQqsZBwSsgcpofZot3LX8h3apgwkOEYSXYHAqTwljPocXSvDQeN7x3fjaNkjr8dAvnFP9rdr7FsfwHmpTIl4xfdihCrqfQxMGZmlM9B6pS_MQ"
+  "refresh_token": "eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE1NDA3NjgxMjYsImlhdCI6MTU0MDc2NDUyNiwiaXNzIjoiaHR0cDovL3Byb29mLnRlc3Q6NTAwMC9tZXRhZGF0YSIsIm5iZiI6MTU0MDc2NDUyNiwiYXVkIjoiMjE3NzVhNTYtOWY3MC00NWEzLThkYTYtOTEzMGEzMzZkODAyIiwianRpIjoiYjQ2YTdiMjktYjRmZC00Zjc2LThkZWUtYzE0MGI5M2MzMGQ2Iiwic3ViIjoiN2M4NWVjNmEtNTA4Zi00ODk2LTg3YjAtNDIyZmRiYjNlYjljIiwidG9rZW5fdHlwZSI6InJlZnJlc2gifQ.SJGc3JnKZjBlaInwwUW5Cmi9zTy7cXVb9-vUaACSqp9w-38KfgUIlYQcwz6BCboxVSSJ1I6nULjffCwPZXWAgMvCsN7OwBSA0MDAjzE9HWMLIc2rmpaqu15EckY75vfR3_xTLRUROGcwcyVsOiwbnUPHCNS9NwA6YrG_c7Ik_AxfhxJTmcN6gmdA6hPcMDTYXAzTOjINcFnTVQd_6IuSUc66NgXXs6R14mrlAHby1-3u8nTJINVl8VzPYBGiv6jHwsi6rn2thshNdqPKqHmxi6ilwdTswbVCYSDYufz2yoKoowRfg_Men1fji3kIIKfjkoRMjzr-0raSPJ7Tamrnvw"
 }
 ```
 
@@ -44,8 +44,8 @@ Referrer-Policy: strict-origin-when-cross-origin
 Cache-Control: private, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-Set-Cookie: _proof=6ace2b0842c4e58b25c5be9e9a72e55e; path=/; HttpOnly
-X-Request-Id: 734ca2e1-91a4-4d1c-80f5-f0c7f8e03dbe
+Set-Cookie: _proof=f93f0b1f0e00b5eb6b11a0a4a1ad2406; path=/; HttpOnly
+X-Request-Id: 7f5d4bda-8667-46c1-8d6c-245163d51ebf
 Transfer-Encoding: chunked
 ```
doc/_includes/oauth-tokens-saml-assertion.html
@@ -6,11 +6,11 @@ Example curl request:
 ```bash
 $ curl http://localhost:5000/oauth/tokens \
   -X POST \
-  -d '{"grant_type":"urn:ietf:params:oauth:grant-type:saml2-bearer","assertion":"PEFzc2VydGlvbiB4bWxucz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgSUQ9Il9jZDQwNjUzZi1hMzNiLTQ2MzUtYTAwMS0yNDY0NGY2YmRiMDQiIElzc3VlSW5zdGFudD0iMjAxOC0xMC0yOFQyMTo1NTo1NFoiIFZlcnNpb249IjIuMCI-PElzc3Vlcj5odHRwOi8vcHJvb2YudGVzdDo1MDAwL21ldGFkYXRhPC9Jc3N1ZXI-PFNpZ25hdHVyZSB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI-PFNpZ25lZEluZm8-PENhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIvPjxSZWZlcmVuY2UgVVJJPSIjX2NkNDA2NTNmLWEzM2ItNDYzNS1hMDAxLTI0NjQ0ZjZiZGIwNCI-PFRyYW5zZm9ybXM-PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8-PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvVHJhbnNmb3Jtcz48RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8-PERpZ2VzdFZhbHVlPlFGQzdBWUhzTSs5SGF5cjlMNndSbWJZbTRyV0xBMytlbGo4WTFkcWV5L009PC9EaWdlc3RWYWx1ZT48L1JlZmVyZW5jZT48L1NpZ25lZEluZm8-PFNpZ25hdHVyZVZhbHVlPk5CQmhzWVlHY1prbWo4SmNGTi92ZDNDWEtwb1ZGLzRVeHlvamg5L0IzVW1aQ1d4WEdSUVVwazk0Q2F0Sjl6RXQzMlNZU3ZTWnQvbDIwb015YWcvOTd4QllNYXdjd3RDYUZXa2pRd2plamp0cTU4K0p3eGtXNlRJV2NrQTRGTmRDaGZzaGFzNE5aelAveHBGVkcxS3k2dVYyZkd5M0ZrRDVYa0xYOVlNb2FnSkM3bEdacXB6KzZkNGdqeVJOdlFQU2hxZC9PTUZxV3Vnek9QU1BkMkxXd1RhU3VGa2IraFJxck5jbnlzeHZRQWgxZVZ4VGIySnVTbU1VTHBQL1hRcUhiQnpwZ1F5bXZkSGwvd3dRekVxVTIrUVpiRytoMGVhT3Nyb2t1MUorOFYwcXBGMW9aWUJpaW50VkZNMllmZ0Rwb0w3QWJtSit4ZHIzb3RHcjkyM3A0UT09PC9TaWduYXR1cmVWYWx1ZT48S2V5SW5mbz48WDUwOURhdGE-PFg1MDlDZXJ0aWZpY2F0ZT5NSUlETnpDQ0FoK2dBd0lCQWdJQkFEQU5CZ2txaGtpRzl3MEJBUXNGQURCZk1Rc3dDUVlEVlFRR0V3SkRRVEVMTUFrR0ExVUVDQXdDUVVJeEVEQU9CZ05WQkFjTUIwTmhiR2RoY25reER6QU5CZ05WQkFvTUJsaHRiRXRwZERFUE1BMEdBMVVFQ3d3R1dHMXNTMmwwTVE4d0RRWURWUVFEREFaWWJXeExhWFF3SGhjTk1UZ3hNREk0TWpFMU5UVXhXaGNOTVRneE1USTNNakUxTlRVeFdqQmZNUXN3Q1FZRFZRUUdFd0pEUVRFTE1Ba0dBMVVFQ0F3Q1FVSXhFREFPQmdOVkJBY01CME5oYkdkaGNua3hEekFOQmdOVkJBb01CbGh0YkV0cGRERVBNQTBHQTFVRUN3d0dXRzFzUzJsME1ROHdEUVlEVlFRRERBWlliV3hMYVhRd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUUMzUUpjWkFNN25DUjlQWHV0d3R5cXNvOVI5RW1rY003K1dzYzFMU3l2ZkY2Nytmcm5iY3VURE1VbUR0SFNqMkJsUmZrSzVJZ3IvL2RYY1dTVlhPSVJWdkxhdFBydVh5ZW5QVy9hcFlrQm5ZVm1YSWxZb21qSy9od1p4T1RXSHBBV2praEM0MHE0eFVjOHVoNTYrcFdmdjcxNFcxbzBkalFsZHVlRmxnWUF0dDc0SUNoM0k0Zll4aXpyQmZTSEMydVNWU0FMZlhwMUY5KzAvQVJWUm93cGljQ2YrcnJYYjN3MUxBN1Q3Qk9nTjZYVStadm54NFlmQStGei9CTVNlZ3E3cTA5eHhpTlRiNkRGZ3I2Y0pnL05IZHZNdGlwcUFzbWk1b0w2T2RXeUZqTHQvUklvallJRFlzaGtSbFdTMTlWNEpYNTlEOFc4LzNSY1YvK3JhRFFrakFnTUJBQUV3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUZhNnRweXM1ZkRPUDZRMkdjWmoreFVrd1dJUVNQMVplelErMm8wSlJvY2k1WU40RWtBUFlZMFliS0xKWGNnalBYR3ZOOXk3WmpzUy9rL1BLU1VidElDdUdndS9IZ2dLL25IS0toR2ZxalpQUFNHcnNsdForV3VUVml0ZnhHaTllMjVaTFRSU0pOZEF4V2ZBVzJPVFBiL01UYStqQzgxTjVuMzU4Q2QrdmFLZ1lDYktyRUYrRW1TMmdYTXlYQmFRUWNuK0VWNC9oV3lQTUI3SHZpaXpYenQrdm5kUittdVJWdW5ndUwxdlZFQTJ0MEhmSTc2R2IvT0czcmRUZFkxMnJERkhuTDRZSFNiL2JxTVBNZGowVXBGNzlaUVBEYXRlK3laSlRuSlFUVnpOU213QTNUZGxiRnhJcEpFWGdpeGdxSTJSK3R4azk5K01nT2RxTmhNZDNYMD08L1g1MDlDZXJ0aWZpY2F0ZT48L1g1MDlEYXRhPjwvS2V5SW5mbz48L1NpZ25hdHVyZT48U3ViamVjdD48TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6dW5zcGVjaWZpZWQiPmplYW5lLmxlZ3Jvc0BlbW1lcmljaC51czwvTmFtZUlEPjxTdWJqZWN0Q29uZmlybWF0aW9uIE1ldGhvZD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmNtOmJlYXJlciI-PFN1YmplY3RDb25maXJtYXRpb25EYXRhIEluUmVzcG9uc2VUbz0iXzhmMjgyYzNiLTBmZmYtNDIyYi05ZmI3LWI2MGI5YTRhMTM4MCIgTm90T25PckFmdGVyPSIyMDE4LTEwLTI4VDIyOjAwOjU0WiIvPjwvU3ViamVjdENvbmZpcm1hdGlvbj48L1N1YmplY3Q-PENvbmRpdGlvbnMgTm90QmVmb3JlPSIyMDE4LTEwLTI4VDIxOjU1OjU0WiIgTm90T25PckFmdGVyPSIyMDE4LTEwLTI5VDAwOjU1OjU0WiI-PEF1ZGllbmNlUmVzdHJpY3Rpb24-PEF1ZGllbmNlPmh0dHA6Ly9wcm9vZi50ZXN0OjUwMDAvbWV0YWRhdGE8L0F1ZGllbmNlPjwvQXVkaWVuY2VSZXN0cmljdGlvbj48L0NvbmRpdGlvbnM-PEF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAxOC0xMC0yOFQyMTo1NTo1NFoiIFNlc3Npb25JbmRleD0iX2NkNDA2NTNmLWEzM2ItNDYzNS1hMDAxLTI0NjQ0ZjZiZGIwNCI-PEF1dGhuQ29udGV4dD48QXV0aG5Db250ZXh0Q2xhc3NSZWY-dXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFjOmNsYXNzZXM6UGFzc3dvcmQ8L0F1dGhuQ29udGV4dENsYXNzUmVmPjwvQXV0aG5Db250ZXh0PjwvQXV0aG5TdGF0ZW1lbnQ-PEF0dHJpYnV0ZVN0YXRlbWVudD48QXR0cmlidXRlIE5hbWU9ImlkIj48QXR0cmlidXRlVmFsdWU-MWZiZjI5ODQtMmQwYi00MmUzLThkYjUtYTVjOWUxNzZhYWJiPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48QXR0cmlidXRlIE5hbWU9ImVtYWlsIj48QXR0cmlidXRlVmFsdWU-amVhbmUubGVncm9zQGVtbWVyaWNoLnVzPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48QXR0cmlidXRlIE5hbWU9ImNyZWF0ZWRfYXQiPjxBdHRyaWJ1dGVWYWx1ZT4yMDE4LTEwLTI4IDIxOjU1OjU0IFVUQzwvQXR0cmlidXRlVmFsdWU-PC9BdHRyaWJ1dGU-PC9BdHRyaWJ1dGVTdGF0ZW1lbnQ-PC9Bc3NlcnRpb24-Cg=="}' \
+  -d '{"grant_type":"urn:ietf:params:oauth:grant-type:saml2-bearer","assertion":"PEFzc2VydGlvbiB4bWxucz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgSUQ9Il9mM2U2NmFhOS0xYTBlLTRkN2YtOTU4OC05MWM4ZDJiNmNjMWIiIElzc3VlSW5zdGFudD0iMjAxOC0xMC0yOFQyMjowODo0NloiIFZlcnNpb249IjIuMCI-PElzc3Vlcj5odHRwOi8vcHJvb2YudGVzdDo1MDAwL21ldGFkYXRhPC9Jc3N1ZXI-PFNpZ25hdHVyZSB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI-PFNpZ25lZEluZm8-PENhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIvPjxSZWZlcmVuY2UgVVJJPSIjX2YzZTY2YWE5LTFhMGUtNGQ3Zi05NTg4LTkxYzhkMmI2Y2MxYiI-PFRyYW5zZm9ybXM-PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8-PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvVHJhbnNmb3Jtcz48RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8-PERpZ2VzdFZhbHVlPlBKNWoyODBlNFl4ckk5Qy9jQURUV3kyb1ZUeTU4NFd4OTAzYnNtQ3dEU2c9PC9EaWdlc3RWYWx1ZT48L1JlZmVyZW5jZT48L1NpZ25lZEluZm8-PFNpZ25hdHVyZVZhbHVlPlRtRWpzcDNmckVONHhPSzNSdTRUQVVyMDVZUnhjcHoxLzRGV3Q2d0xqdDRGZUxiYlc3Skk4YklnVWtqTVBRazR2UDUxK0hnTFZqMkRKbGQ2U1ViWDR5QkxqUVFMOTRqZkVQTFJhZHMxK3g0R2VBZXFnenQzNGRieXB5bjRDaVBTSVBDbldEZTNISVYzdEhvTjBlU1lCb2ZnSC9pdFdDYWRtdkliL2U4blMwN1hxYVc5bGFQblJFYW1EZDdldkFqdlByY0xpTThWSzRNRGYvL1MzWU90Ymg4RFRCcWwzUnh0enBISXA1Tzhqa0o4Ti8rN2ZEdTFYaVRpUXREWStqUjc1SmJPenlYdmFtelkrdDBDZkRDTjEvWnAvaVlFMUM4YmRVY25waUE1ZWRybDViUGpJMWJvaDdkaUM2b2l2SDF4YmNEMXMyeldlaGZLQnY1dC9DZEU5Zz09PC9TaWduYXR1cmVWYWx1ZT48S2V5SW5mbz48WDUwOURhdGE-PFg1MDlDZXJ0aWZpY2F0ZT5NSUlETnpDQ0FoK2dBd0lCQWdJQkFEQU5CZ2txaGtpRzl3MEJBUXNGQURCZk1Rc3dDUVlEVlFRR0V3SkRRVEVMTUFrR0ExVUVDQXdDUVVJeEVEQU9CZ05WQkFjTUIwTmhiR2RoY25reER6QU5CZ05WQkFvTUJsaHRiRXRwZERFUE1BMEdBMVVFQ3d3R1dHMXNTMmwwTVE4d0RRWURWUVFEREFaWWJXeExhWFF3SGhjTk1UZ3hNREk0TWpJd09EUTBXaGNOTVRneE1USTNNakl3T0RRMFdqQmZNUXN3Q1FZRFZRUUdFd0pEUVRFTE1Ba0dBMVVFQ0F3Q1FVSXhFREFPQmdOVkJBY01CME5oYkdkaGNua3hEekFOQmdOVkJBb01CbGh0YkV0cGRERVBNQTBHQTFVRUN3d0dXRzFzUzJsME1ROHdEUVlEVlFRRERBWlliV3hMYVhRd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUURHUEphbVJFZjEvYnhhR0RscEZ2N3o1MW9VSmJOSHhsREJuOUhVU2xDN3V5bVNrU2ZJdG9QcFFJNUpnSFMvWDdTU3FGUXQzUjNOZWpmUURNa0E3L2VkVDRCazBNREt1NVE4NFU4VXVrU1RzSkNzMWc3VHkyMm1RSm8wVnJCOVNWZTFCdDhqZ2M2NFdGaDBIRElFZmtSalhmdzZHaUh6eTIxc1ZodVNGakQ2T3dwdWJMUGs1MXpBSUt0cXNpbU5hRldjTXdsODZ0N2JENWtLY0pUWTRDbmp5QjU0S1FQUFVwQk1zaWpFdHdzUGdSc3VURU9ZRW02eHd4SzBJTXJrVDdKelEvRWhXQ0hDYURpZ0NLczdxbnU4cWxEejFkQlNuSmxxVGZocUU5UmRlRzladlZiUUhyUkdzSTdrU2dhS01LMTEwdjkrb29JUEFWREdyZzRNYWJBbkFnTUJBQUV3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUJ4MFZUdlVoU1oyZWowZmZtVkxaM2xNUlkwQlVMWC85SHEwK1BaejJzODlDanY2MzJhL2lnTGR3TVk1MEt3aC9hb05hL1Y2WWxTSlVwa0pocmRFQ3k4RTJFNkQ1NG13cHJ6WGgvZTJZN3JOYUpQa0t4RDMxTG1McDlsbGhuQXlYS045M0ZrbnVBUDhnUTVDcFYwblVhVnRqeDFCNC93VXlEczV0ZTdxVmkzSUh3MWs1OW1ES3UvYkpHRlh5VlhMQ3V5eFNuZFh3SWZRY0d3bHdneDJEUzBRTnFERjQwZkI0ZnJIYm14a09rclNpb0pFQ2JyTktSbzYyZFZkblQvSlNUR3dKb0JZNXJPYlQ0a1dEL1gzR2hSVEc5ZFVLZ0RtTHd0eXJrRUkrNDVMSFNNc051LzlOK0lxM1M1N2QvdVZzemhrVHhBZWl2NGVXV2gxdmp4VmJDTT08L1g1MDlDZXJ0aWZpY2F0ZT48L1g1MDlEYXRhPjwvS2V5SW5mbz48L1NpZ25hdHVyZT48U3ViamVjdD48TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6dW5zcGVjaWZpZWQiPmRvbmFsZEBraWhuZ2lzbGFzb24udXM8L05hbWVJRD48U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxTdWJqZWN0Q29uZmlybWF0aW9uRGF0YSBJblJlc3BvbnNlVG89Il83YmM3MmYwOC1lODI2LTRjYmMtODEyOS02MzFiMzgyNmYzZWQiIE5vdE9uT3JBZnRlcj0iMjAxOC0xMC0yOFQyMjoxMzo0NloiLz48L1N1YmplY3RDb25maXJtYXRpb24-PC9TdWJqZWN0PjxDb25kaXRpb25zIE5vdEJlZm9yZT0iMjAxOC0xMC0yOFQyMjowODo0NloiIE5vdE9uT3JBZnRlcj0iMjAxOC0xMC0yOVQwMTowODo0NloiPjxBdWRpZW5jZVJlc3RyaWN0aW9uPjxBdWRpZW5jZT5odHRwOi8vcHJvb2YudGVzdDo1MDAwL21ldGFkYXRhPC9BdWRpZW5jZT48L0F1ZGllbmNlUmVzdHJpY3Rpb24-PC9Db25kaXRpb25zPjxBdXRoblN0YXRlbWVudCBBdXRobkluc3RhbnQ9IjIwMTgtMTAtMjhUMjI6MDg6NDZaIiBTZXNzaW9uSW5kZXg9Il9mM2U2NmFhOS0xYTBlLTRkN2YtOTU4OC05MWM4ZDJiNmNjMWIiPjxBdXRobkNvbnRleHQ-PEF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlBhc3N3b3JkPC9BdXRobkNvbnRleHRDbGFzc1JlZj48L0F1dGhuQ29udGV4dD48L0F1dGhuU3RhdGVtZW50PjxBdHRyaWJ1dGVTdGF0ZW1lbnQ-PEF0dHJpYnV0ZSBOYW1lPSJpZCI-PEF0dHJpYnV0ZVZhbHVlPjYzZjhlM2FlLTMwYTktNDgyYS1hYmVkLWE0MjZhOTI1ZTQ4NjwvQXR0cmlidXRlVmFsdWU-PC9BdHRyaWJ1dGU-PEF0dHJpYnV0ZSBOYW1lPSJlbWFpbCI-PEF0dHJpYnV0ZVZhbHVlPmRvbmFsZEBraWhuZ2lzbGFzb24udXM8L0F0dHJpYnV0ZVZhbHVlPjwvQXR0cmlidXRlPjxBdHRyaWJ1dGUgTmFtZT0iY3JlYXRlZF9hdCI-PEF0dHJpYnV0ZVZhbHVlPjIwMTgtMTAtMjggMjI6MDg6NDYgVVRDPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48L0F0dHJpYnV0ZVN0YXRlbWVudD48L0Fzc2VydGlvbj4K"}' \
   -H "Accept: application/json" \
   -H "Content-Type: application/json" \
   -H "User-Agent: net/hippie 0.1.9" \
-  -H "Authorization: Basic ZWNhYzUxN2EtZDA1OC00MzllLTg5NDktMmMzOTJjNWE5MzE2OjZKR1lYaXZYeHZ2MldMUkVzV1JGMk4xUA==" \
+  -H "Authorization: Basic MDAwMGEwNGItOTE3NS00NDdmLTg4MzktNzFiN2U3OTUwYjUzOk04Z3JtdlplR20yM21wa1BxWGF6cXFGYg==" \
   -H "Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3"
 ```
 Request Headers:
@@ -19,7 +19,7 @@ Request Headers:
 Accept: application/json
 Content-Type: application/json
 User-Agent: net/hippie 0.1.9
-Authorization: Basic ZWNhYzUxN2EtZDA1OC00MzllLTg5NDktMmMzOTJjNWE5MzE2OjZKR1lYaXZYeHZ2MldMUkVzV1JGMk4xUA==
+Authorization: Basic MDAwMGEwNGItOTE3NS00NDdmLTg4MzktNzFiN2U3OTUwYjUzOk04Z3JtdlplR20yM21wa1BxWGF6cXFGYg==
 Accept-Encoding: gzip;q=1.0,deflate;q=0.6,identity;q=0.3
 ```
 
@@ -28,7 +28,7 @@ Request Body:
 ```json
 {
   "grant_type": "urn:ietf:params:oauth:grant-type:saml2-bearer",
-  "assertion": "PEFzc2VydGlvbiB4bWxucz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgSUQ9Il9jZDQwNjUzZi1hMzNiLTQ2MzUtYTAwMS0yNDY0NGY2YmRiMDQiIElzc3VlSW5zdGFudD0iMjAxOC0xMC0yOFQyMTo1NTo1NFoiIFZlcnNpb249IjIuMCI-PElzc3Vlcj5odHRwOi8vcHJvb2YudGVzdDo1MDAwL21ldGFkYXRhPC9Jc3N1ZXI-PFNpZ25hdHVyZSB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI-PFNpZ25lZEluZm8-PENhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIvPjxSZWZlcmVuY2UgVVJJPSIjX2NkNDA2NTNmLWEzM2ItNDYzNS1hMDAxLTI0NjQ0ZjZiZGIwNCI-PFRyYW5zZm9ybXM-PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8-PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvVHJhbnNmb3Jtcz48RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8-PERpZ2VzdFZhbHVlPlFGQzdBWUhzTSs5SGF5cjlMNndSbWJZbTRyV0xBMytlbGo4WTFkcWV5L009PC9EaWdlc3RWYWx1ZT48L1JlZmVyZW5jZT48L1NpZ25lZEluZm8-PFNpZ25hdHVyZVZhbHVlPk5CQmhzWVlHY1prbWo4SmNGTi92ZDNDWEtwb1ZGLzRVeHlvamg5L0IzVW1aQ1d4WEdSUVVwazk0Q2F0Sjl6RXQzMlNZU3ZTWnQvbDIwb015YWcvOTd4QllNYXdjd3RDYUZXa2pRd2plamp0cTU4K0p3eGtXNlRJV2NrQTRGTmRDaGZzaGFzNE5aelAveHBGVkcxS3k2dVYyZkd5M0ZrRDVYa0xYOVlNb2FnSkM3bEdacXB6KzZkNGdqeVJOdlFQU2hxZC9PTUZxV3Vnek9QU1BkMkxXd1RhU3VGa2IraFJxck5jbnlzeHZRQWgxZVZ4VGIySnVTbU1VTHBQL1hRcUhiQnpwZ1F5bXZkSGwvd3dRekVxVTIrUVpiRytoMGVhT3Nyb2t1MUorOFYwcXBGMW9aWUJpaW50VkZNMllmZ0Rwb0w3QWJtSit4ZHIzb3RHcjkyM3A0UT09PC9TaWduYXR1cmVWYWx1ZT48S2V5SW5mbz48WDUwOURhdGE-PFg1MDlDZXJ0aWZpY2F0ZT5NSUlETnpDQ0FoK2dBd0lCQWdJQkFEQU5CZ2txaGtpRzl3MEJBUXNGQURCZk1Rc3dDUVlEVlFRR0V3SkRRVEVMTUFrR0ExVUVDQXdDUVVJeEVEQU9CZ05WQkFjTUIwTmhiR2RoY25reER6QU5CZ05WQkFvTUJsaHRiRXRwZERFUE1BMEdBMVVFQ3d3R1dHMXNTMmwwTVE4d0RRWURWUVFEREFaWWJXeExhWFF3SGhjTk1UZ3hNREk0TWpFMU5UVXhXaGNOTVRneE1USTNNakUxTlRVeFdqQmZNUXN3Q1FZRFZRUUdFd0pEUVRFTE1Ba0dBMVVFQ0F3Q1FVSXhFREFPQmdOVkJBY01CME5oYkdkaGNua3hEekFOQmdOVkJBb01CbGh0YkV0cGRERVBNQTBHQTFVRUN3d0dXRzFzUzJsME1ROHdEUVlEVlFRRERBWlliV3hMYVhRd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUUMzUUpjWkFNN25DUjlQWHV0d3R5cXNvOVI5RW1rY003K1dzYzFMU3l2ZkY2Nytmcm5iY3VURE1VbUR0SFNqMkJsUmZrSzVJZ3IvL2RYY1dTVlhPSVJWdkxhdFBydVh5ZW5QVy9hcFlrQm5ZVm1YSWxZb21qSy9od1p4T1RXSHBBV2praEM0MHE0eFVjOHVoNTYrcFdmdjcxNFcxbzBkalFsZHVlRmxnWUF0dDc0SUNoM0k0Zll4aXpyQmZTSEMydVNWU0FMZlhwMUY5KzAvQVJWUm93cGljQ2YrcnJYYjN3MUxBN1Q3Qk9nTjZYVStadm54NFlmQStGei9CTVNlZ3E3cTA5eHhpTlRiNkRGZ3I2Y0pnL05IZHZNdGlwcUFzbWk1b0w2T2RXeUZqTHQvUklvallJRFlzaGtSbFdTMTlWNEpYNTlEOFc4LzNSY1YvK3JhRFFrakFnTUJBQUV3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUZhNnRweXM1ZkRPUDZRMkdjWmoreFVrd1dJUVNQMVplelErMm8wSlJvY2k1WU40RWtBUFlZMFliS0xKWGNnalBYR3ZOOXk3WmpzUy9rL1BLU1VidElDdUdndS9IZ2dLL25IS0toR2ZxalpQUFNHcnNsdForV3VUVml0ZnhHaTllMjVaTFRSU0pOZEF4V2ZBVzJPVFBiL01UYStqQzgxTjVuMzU4Q2QrdmFLZ1lDYktyRUYrRW1TMmdYTXlYQmFRUWNuK0VWNC9oV3lQTUI3SHZpaXpYenQrdm5kUittdVJWdW5ndUwxdlZFQTJ0MEhmSTc2R2IvT0czcmRUZFkxMnJERkhuTDRZSFNiL2JxTVBNZGowVXBGNzlaUVBEYXRlK3laSlRuSlFUVnpOU213QTNUZGxiRnhJcEpFWGdpeGdxSTJSK3R4azk5K01nT2RxTmhNZDNYMD08L1g1MDlDZXJ0aWZpY2F0ZT48L1g1MDlEYXRhPjwvS2V5SW5mbz48L1NpZ25hdHVyZT48U3ViamVjdD48TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6dW5zcGVjaWZpZWQiPmplYW5lLmxlZ3Jvc0BlbW1lcmljaC51czwvTmFtZUlEPjxTdWJqZWN0Q29uZmlybWF0aW9uIE1ldGhvZD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmNtOmJlYXJlciI-PFN1YmplY3RDb25maXJtYXRpb25EYXRhIEluUmVzcG9uc2VUbz0iXzhmMjgyYzNiLTBmZmYtNDIyYi05ZmI3LWI2MGI5YTRhMTM4MCIgTm90T25PckFmdGVyPSIyMDE4LTEwLTI4VDIyOjAwOjU0WiIvPjwvU3ViamVjdENvbmZpcm1hdGlvbj48L1N1YmplY3Q-PENvbmRpdGlvbnMgTm90QmVmb3JlPSIyMDE4LTEwLTI4VDIxOjU1OjU0WiIgTm90T25PckFmdGVyPSIyMDE4LTEwLTI5VDAwOjU1OjU0WiI-PEF1ZGllbmNlUmVzdHJpY3Rpb24-PEF1ZGllbmNlPmh0dHA6Ly9wcm9vZi50ZXN0OjUwMDAvbWV0YWRhdGE8L0F1ZGllbmNlPjwvQXVkaWVuY2VSZXN0cmljdGlvbj48L0NvbmRpdGlvbnM-PEF1dGhuU3RhdGVtZW50IEF1dGhuSW5zdGFudD0iMjAxOC0xMC0yOFQyMTo1NTo1NFoiIFNlc3Npb25JbmRleD0iX2NkNDA2NTNmLWEzM2ItNDYzNS1hMDAxLTI0NjQ0ZjZiZGIwNCI-PEF1dGhuQ29udGV4dD48QXV0aG5Db250ZXh0Q2xhc3NSZWY-dXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFjOmNsYXNzZXM6UGFzc3dvcmQ8L0F1dGhuQ29udGV4dENsYXNzUmVmPjwvQXV0aG5Db250ZXh0PjwvQXV0aG5TdGF0ZW1lbnQ-PEF0dHJpYnV0ZVN0YXRlbWVudD48QXR0cmlidXRlIE5hbWU9ImlkIj48QXR0cmlidXRlVmFsdWU-MWZiZjI5ODQtMmQwYi00MmUzLThkYjUtYTVjOWUxNzZhYWJiPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48QXR0cmlidXRlIE5hbWU9ImVtYWlsIj48QXR0cmlidXRlVmFsdWU-amVhbmUubGVncm9zQGVtbWVyaWNoLnVzPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48QXR0cmlidXRlIE5hbWU9ImNyZWF0ZWRfYXQiPjxBdHRyaWJ1dGVWYWx1ZT4yMDE4LTEwLTI4IDIxOjU1OjU0IFVUQzwvQXR0cmlidXRlVmFsdWU-PC9BdHRyaWJ1dGU-PC9BdHRyaWJ1dGVTdGF0ZW1lbnQ-PC9Bc3NlcnRpb24-Cg=="
+  "assertion": "PEFzc2VydGlvbiB4bWxucz0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6Mi4wOmFzc2VydGlvbiIgSUQ9Il9mM2U2NmFhOS0xYTBlLTRkN2YtOTU4OC05MWM4ZDJiNmNjMWIiIElzc3VlSW5zdGFudD0iMjAxOC0xMC0yOFQyMjowODo0NloiIFZlcnNpb249IjIuMCI-PElzc3Vlcj5odHRwOi8vcHJvb2YudGVzdDo1MDAwL21ldGFkYXRhPC9Jc3N1ZXI-PFNpZ25hdHVyZSB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC8wOS94bWxkc2lnIyI-PFNpZ25lZEluZm8-PENhbm9uaWNhbGl6YXRpb25NZXRob2QgQWxnb3JpdGhtPSJodHRwOi8vd3d3LnczLm9yZy8yMDAxLzEwL3htbC1leGMtYzE0biMiLz48U2lnbmF0dXJlTWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxkc2lnLW1vcmUjcnNhLXNoYTI1NiIvPjxSZWZlcmVuY2UgVVJJPSIjX2YzZTY2YWE5LTFhMGUtNGQ3Zi05NTg4LTkxYzhkMmI2Y2MxYiI-PFRyYW5zZm9ybXM-PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvMDkveG1sZHNpZyNlbnZlbG9wZWQtc2lnbmF0dXJlIi8-PFRyYW5zZm9ybSBBbGdvcml0aG09Imh0dHA6Ly93d3cudzMub3JnLzIwMDEvMTAveG1sLWV4Yy1jMTRuIyIvPjwvVHJhbnNmb3Jtcz48RGlnZXN0TWV0aG9kIEFsZ29yaXRobT0iaHR0cDovL3d3dy53My5vcmcvMjAwMS8wNC94bWxlbmMjc2hhMjU2Ii8-PERpZ2VzdFZhbHVlPlBKNWoyODBlNFl4ckk5Qy9jQURUV3kyb1ZUeTU4NFd4OTAzYnNtQ3dEU2c9PC9EaWdlc3RWYWx1ZT48L1JlZmVyZW5jZT48L1NpZ25lZEluZm8-PFNpZ25hdHVyZVZhbHVlPlRtRWpzcDNmckVONHhPSzNSdTRUQVVyMDVZUnhjcHoxLzRGV3Q2d0xqdDRGZUxiYlc3Skk4YklnVWtqTVBRazR2UDUxK0hnTFZqMkRKbGQ2U1ViWDR5QkxqUVFMOTRqZkVQTFJhZHMxK3g0R2VBZXFnenQzNGRieXB5bjRDaVBTSVBDbldEZTNISVYzdEhvTjBlU1lCb2ZnSC9pdFdDYWRtdkliL2U4blMwN1hxYVc5bGFQblJFYW1EZDdldkFqdlByY0xpTThWSzRNRGYvL1MzWU90Ymg4RFRCcWwzUnh0enBISXA1Tzhqa0o4Ti8rN2ZEdTFYaVRpUXREWStqUjc1SmJPenlYdmFtelkrdDBDZkRDTjEvWnAvaVlFMUM4YmRVY25waUE1ZWRybDViUGpJMWJvaDdkaUM2b2l2SDF4YmNEMXMyeldlaGZLQnY1dC9DZEU5Zz09PC9TaWduYXR1cmVWYWx1ZT48S2V5SW5mbz48WDUwOURhdGE-PFg1MDlDZXJ0aWZpY2F0ZT5NSUlETnpDQ0FoK2dBd0lCQWdJQkFEQU5CZ2txaGtpRzl3MEJBUXNGQURCZk1Rc3dDUVlEVlFRR0V3SkRRVEVMTUFrR0ExVUVDQXdDUVVJeEVEQU9CZ05WQkFjTUIwTmhiR2RoY25reER6QU5CZ05WQkFvTUJsaHRiRXRwZERFUE1BMEdBMVVFQ3d3R1dHMXNTMmwwTVE4d0RRWURWUVFEREFaWWJXeExhWFF3SGhjTk1UZ3hNREk0TWpJd09EUTBXaGNOTVRneE1USTNNakl3T0RRMFdqQmZNUXN3Q1FZRFZRUUdFd0pEUVRFTE1Ba0dBMVVFQ0F3Q1FVSXhFREFPQmdOVkJBY01CME5oYkdkaGNua3hEekFOQmdOVkJBb01CbGh0YkV0cGRERVBNQTBHQTFVRUN3d0dXRzFzUzJsME1ROHdEUVlEVlFRRERBWlliV3hMYVhRd2dnRWlNQTBHQ1NxR1NJYjNEUUVCQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUURHUEphbVJFZjEvYnhhR0RscEZ2N3o1MW9VSmJOSHhsREJuOUhVU2xDN3V5bVNrU2ZJdG9QcFFJNUpnSFMvWDdTU3FGUXQzUjNOZWpmUURNa0E3L2VkVDRCazBNREt1NVE4NFU4VXVrU1RzSkNzMWc3VHkyMm1RSm8wVnJCOVNWZTFCdDhqZ2M2NFdGaDBIRElFZmtSalhmdzZHaUh6eTIxc1ZodVNGakQ2T3dwdWJMUGs1MXpBSUt0cXNpbU5hRldjTXdsODZ0N2JENWtLY0pUWTRDbmp5QjU0S1FQUFVwQk1zaWpFdHdzUGdSc3VURU9ZRW02eHd4SzBJTXJrVDdKelEvRWhXQ0hDYURpZ0NLczdxbnU4cWxEejFkQlNuSmxxVGZocUU5UmRlRzladlZiUUhyUkdzSTdrU2dhS01LMTEwdjkrb29JUEFWREdyZzRNYWJBbkFnTUJBQUV3RFFZSktvWklodmNOQVFFTEJRQURnZ0VCQUJ4MFZUdlVoU1oyZWowZmZtVkxaM2xNUlkwQlVMWC85SHEwK1BaejJzODlDanY2MzJhL2lnTGR3TVk1MEt3aC9hb05hL1Y2WWxTSlVwa0pocmRFQ3k4RTJFNkQ1NG13cHJ6WGgvZTJZN3JOYUpQa0t4RDMxTG1McDlsbGhuQXlYS045M0ZrbnVBUDhnUTVDcFYwblVhVnRqeDFCNC93VXlEczV0ZTdxVmkzSUh3MWs1OW1ES3UvYkpHRlh5VlhMQ3V5eFNuZFh3SWZRY0d3bHdneDJEUzBRTnFERjQwZkI0ZnJIYm14a09rclNpb0pFQ2JyTktSbzYyZFZkblQvSlNUR3dKb0JZNXJPYlQ0a1dEL1gzR2hSVEc5ZFVLZ0RtTHd0eXJrRUkrNDVMSFNNc051LzlOK0lxM1M1N2QvdVZzemhrVHhBZWl2NGVXV2gxdmp4VmJDTT08L1g1MDlDZXJ0aWZpY2F0ZT48L1g1MDlEYXRhPjwvS2V5SW5mbz48L1NpZ25hdHVyZT48U3ViamVjdD48TmFtZUlEIEZvcm1hdD0idXJuOm9hc2lzOm5hbWVzOnRjOlNBTUw6MS4xOm5hbWVpZC1mb3JtYXQ6dW5zcGVjaWZpZWQiPmRvbmFsZEBraWhuZ2lzbGFzb24udXM8L05hbWVJRD48U3ViamVjdENvbmZpcm1hdGlvbiBNZXRob2Q9InVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDpjbTpiZWFyZXIiPjxTdWJqZWN0Q29uZmlybWF0aW9uRGF0YSBJblJlc3BvbnNlVG89Il83YmM3MmYwOC1lODI2LTRjYmMtODEyOS02MzFiMzgyNmYzZWQiIE5vdE9uT3JBZnRlcj0iMjAxOC0xMC0yOFQyMjoxMzo0NloiLz48L1N1YmplY3RDb25maXJtYXRpb24-PC9TdWJqZWN0PjxDb25kaXRpb25zIE5vdEJlZm9yZT0iMjAxOC0xMC0yOFQyMjowODo0NloiIE5vdE9uT3JBZnRlcj0iMjAxOC0xMC0yOVQwMTowODo0NloiPjxBdWRpZW5jZVJlc3RyaWN0aW9uPjxBdWRpZW5jZT5odHRwOi8vcHJvb2YudGVzdDo1MDAwL21ldGFkYXRhPC9BdWRpZW5jZT48L0F1ZGllbmNlUmVzdHJpY3Rpb24-PC9Db25kaXRpb25zPjxBdXRoblN0YXRlbWVudCBBdXRobkluc3RhbnQ9IjIwMTgtMTAtMjhUMjI6MDg6NDZaIiBTZXNzaW9uSW5kZXg9Il9mM2U2NmFhOS0xYTBlLTRkN2YtOTU4OC05MWM4ZDJiNmNjMWIiPjxBdXRobkNvbnRleHQ-PEF1dGhuQ29udGV4dENsYXNzUmVmPnVybjpvYXNpczpuYW1lczp0YzpTQU1MOjIuMDphYzpjbGFzc2VzOlBhc3N3b3JkPC9BdXRobkNvbnRleHRDbGFzc1JlZj48L0F1dGhuQ29udGV4dD48L0F1dGhuU3RhdGVtZW50PjxBdHRyaWJ1dGVTdGF0ZW1lbnQ-PEF0dHJpYnV0ZSBOYW1lPSJpZCI-PEF0dHJpYnV0ZVZhbHVlPjYzZjhlM2FlLTMwYTktNDgyYS1hYmVkLWE0MjZhOTI1ZTQ4NjwvQXR0cmlidXRlVmFsdWU-PC9BdHRyaWJ1dGU-PEF0dHJpYnV0ZSBOYW1lPSJlbWFpbCI-PEF0dHJpYnV0ZVZhbHVlPmRvbmFsZEBraWhuZ2lzbGFzb24udXM8L0F0dHJpYnV0ZVZhbHVlPjwvQXR0cmlidXRlPjxBdHRyaWJ1dGUgTmFtZT0iY3JlYXRlZF9hdCI-PEF0dHJpYnV0ZVZhbHVlPjIwMTgtMTAtMjggMjI6MDg6NDYgVVRDPC9BdHRyaWJ1dGVWYWx1ZT48L0F0dHJpYnV0ZT48L0F0dHJpYnV0ZVN0YXRlbWVudD48L0Fzc2VydGlvbj4K"
 }
 ```
 
@@ -44,8 +44,8 @@ Referrer-Policy: strict-origin-when-cross-origin
 Cache-Control: private, no-store
 Pragma: no-cache
 Content-Type: application/json; charset=utf-8
-Set-Cookie: _proof=55f31f0ad9af5c7d103e9ceab3a709c1; path=/; HttpOnly
-X-Request-Id: b59f6e51-56a1-4e2b-b48b-66681ea6fc7f
+Set-Cookie: _proof=eedf5bc528732dd92935e01cbe8c78ee; path=/; HttpOnly
+X-Request-Id: bb48a9f2-3078-4e55-bf47-9c6962f4289d
 Transfer-Encoding: chunked
 ```
doc/_posts/2018-10-28-oauth-proof-key-code-exchange.markdown
@@ -0,0 +1,30 @@
+---
+layout: post
+title:  "OAuth 2.0 - Proof Key Code Exchange"
+date:   2018-10-28 14:00:00 -0700
+permalink: /oauth/client-proof-key-code-exchange.html
+categories: oauth
+---
+
+This endpoint adhears Proof Key Code Exchange described in [RFC-7636](https://tools.ietf.org/html/rfc7636).
+
+```text
+                                                 +-------------------+
+                                                 |   Authz Server    |
+       +--------+                                | +---------------+ |
+       |        |--(A)- Authorization Request ---->|               | |
+       |        |       + t(code_verifier), t_m  | | Authorization | |
+       |        |                                | |    Endpoint   | |
+       |        |<-(B)---- Authorization Code -----|               | |
+       |        |                                | +---------------+ |
+       | Client |                                |                   |
+       |        |                                | +---------------+ |
+       |        |--(C)-- Access Token Request ---->|               | |
+       |        |          + code_verifier       | |    Token      | |
+       |        |                                | |   Endpoint    | |
+       |        |<-(D)------ Access Token ---------|               | |
+       +--------+                                | +---------------+ |
+```
+[Section 1.1](https://tools.ietf.org/html/rfc7636#section-1.1)
+
+{% include oauth-tokens-pkce.html %}
spec/requests/oauth/tokens_spec.rb
@@ -58,7 +58,6 @@ RSpec.describe '/oauth/tokens' do
         let(:json) { JSON.parse(response.body, symbolize_names: true) }
 
         before do
-          post '/oauth/tokens', params: { grant_type: 'authorization_code', code: SecureRandom.hex(20) }, headers: headers
           post '/oauth/tokens', params: { grant_type: 'authorization_code', code: authorization.code, code_verifier: code_verifier }, headers: headers
         end
spec/documentation.rb
@@ -103,4 +103,15 @@ RSpec.describe "documentation" do
       expect(response.code).to eql('201')
     end
   end
+
+  specify do
+    code_verifier = SecureRandom.hex(128)
+    authorization = create(:authorization, client: client, challenge: Base64.urlsafe_encode64(Digest::SHA256.hexdigest(code_verifier)), challenge_method: :sha256)
+    headers = { 'Authorization' => ActionController::HttpAuthentication::Basic.encode_credentials(client.to_param, client.password) }
+    body = { grant_type: 'authorization_code', code: authorization.code, code_verifier: code_verifier }
+    VCR.use_cassette("oauth-tokens-pkce") do
+      response = hippie.post("#{scheme}://#{host}/oauth/tokens", body: body, headers: headers)
+      expect(response.code).to eql('200')
+    end
+  end
 end