This service issues short-lived JWTs to users authenticated by the configured protection provider (Cloudflare Access, HTTP Basic, GitHub OAuth, or dev-only any-auth).
/auth/token — issue a JWT/auth/login?return_to=… — issue a JWT and redirect to an allow-listed host/auth/embed?target_origin=… — issue a JWT and post it to an allow-listed parent window via postMessage (silent iframe path)/auth/userinfo — identity introspection/auth/logout — provider-dispatched logout (clears session cookie / rotates Basic realm / etc.)/jwks.json — public keys (for verifiers)/.well-known/openid-configuration — discovery/client-v{1|2}.js — drop-in browser client (window.ethpandaops.authenticatoor); v2 adds shared-session token management. /client.js stays as the legacy v1 path/clientFrame?v=2&origin=… — hidden shared-session iframe page mounted by the v2 client (frame script inlined, hash-pinned CSP)