---
api: '[PREVIEW] Revolut Wallet Loyalty Callbacks'
---

# Retrieve authorisation server metadata

:::warning [Pre-release preview]
This is a pre-release preview of upcoming documentation.
The features, workflows, and UI described here are subject to change before the final release.
:::

Your OpenID Connect discovery document (OpenID Connect Discovery 1.0). Revolut reads it
from `{issuer}/.well-known/openid-configuration`, using the issuer URL you register
during onboarding, to find your Pushed Authorization Request (PAR), authorisation, and
token endpoints and the keys that sign your ID tokens. Revolut then calls the URLs the
document lists. Serve it publicly over HTTPS; it carries no secrets.

Your document can list more values than this reference requires, for example extra grant
types or `prompt` values. Revolut relies on the following:
- PAR is mandatory (`require_pushed_authorization_requests: true`) and PKCE uses `S256`.
- Authorisation responses carry `iss` (RFC 9207), so Revolut can tell your authorisation
  server apart from other partners' servers that share its redirect URI.
- `prompt_values_supported` includes `login` and `create`.
- `id_token_signing_alg_values_supported` includes `RS256`, as OpenID Connect Discovery
  requires. `ES256` is also accepted; the algorithm you sign with is agreed when Revolut's
  client is registered during onboarding.
- `token_endpoint_auth_methods_supported` includes the client-authentication method
  registered for Revolut: `client_secret_post`, `private_key_jwt`, `tls_client_auth`, or
  `self_signed_tls_client_auth`. Revolut never uses `client_secret_basic`.
- `grant_types_supported` includes `client_credentials` if you implement
  `POST /loyalty/auto-enrol` or accept OAuth 2.0 on `POST /loyalty/apply`.

Keep the previous signing key in your JSON Web Key Set (JWKS) while you rotate keys, so
ID tokens signed with it still verify.

## Endpoint

GET `/.well-known/openid-configuration`

## Parameters

### header parameters

- `Revolut-Api-Version` (string, optional)
  Contract version Revolut is calling with. Revolut sends it to your authorisation server
  too, but you may ignore it there: never reject a request because of this header.

- `Request-Id` (string, optional)
  Revolut's correlation ID for this request. You may ignore it; echoing it is optional on authorisation-server endpoints.

## Returns

### 200

Your authorisation server metadata.

#### Response attributes

- `issuer` (string)
    Your issuer URL, as registered during onboarding. It must match the `iss` claim of
    your ID tokens and the `iss` parameter on your authorisation responses.
- `authorization_endpoint` (string)
    URL of your authorisation endpoint (`GET /oauth2/authorize` in this reference).
- `token_endpoint` (string)
    URL of your token endpoint (`POST /oauth2/token` in this reference).
- `pushed_authorization_request_endpoint` (string)
    URL of your PAR endpoint (`POST /oauth2/par` in this reference, RFC 9126).
- `jwks_uri` (string)
    URL of your JSON Web Key Set (JWKS, RFC 7517): the public keys that sign your ID
    tokens.
- `response_types_supported` (array of string)
    Must include `code`.
- `subject_types_supported` (array of string)
    Subject identifier types you support, for example `public`.
- `id_token_signing_alg_values_supported` (array of string)
    Must include `RS256`, as OpenID Connect Discovery requires. `ES256` is also accepted;
    the algorithm you sign with is agreed during onboarding.
- `code_challenge_methods_supported` (array of string)
    Must include `S256` (RFC 7636).
- `require_pushed_authorization_requests` (boolean)
    Must be `true`. Your authorisation endpoint accepts only requests pushed through PAR.
- `authorization_response_iss_parameter_supported` (boolean)
    Must be `true`. Every authorisation response carries `iss` (RFC 9207).
- `prompt_values_supported` (array of string)
    Must include `login` and `create` (OpenID Connect Prompt Create).
- `grant_types_supported` (array of string)
    Must include `authorization_code`, and `client_credentials` if you implement
    `POST /loyalty/auto-enrol` or accept OAuth 2.0 on `POST /loyalty/apply`.
- `token_endpoint_auth_methods_supported` (array of string)
    Must include the client-authentication method registered for Revolut:
    `client_secret_post`, `private_key_jwt`, `tls_client_auth`, or
    `self_signed_tls_client_auth`. Revolut never uses `client_secret_basic`.
- `token_endpoint_auth_signing_alg_values_supported` (array of string, optional)
    Algorithms you accept for private key JWT client assertions. Required when
    `token_endpoint_auth_methods_supported` includes `private_key_jwt` (RFC 8414).
- `mtls_endpoint_aliases` (object, optional)
    Endpoint URLs that require mTLS (RFC 8705), when mTLS is your registered
    client-authentication method. Revolut uses them instead of the standard endpoint
    URLs.
- `scopes_supported` (array of string, optional)
    Scopes you support, for example `openid`, `loyalty.profile`, `loyalty.enrol`, and
    `loyalty.apply`.