Identity API overview
Identity exposes protocol endpoints relative to a tenant issuer and two protected management surfaces. Start from the exact issuer assigned to the tenant; paths alone do not identify a security boundary.
Validate iss, aud, signature and active token state at the receiving resource server. Treat (issuer, subject) as the stable account identifier.
Discover endpoints, run Authorization Code with PKCE, exchange and refresh tokens, inspect access tokens and read UserInfo.
Use the cookie-free native adapter for first-party password, social, MFA, registration and recovery flows.
Automate tenants, users, OAuth clients, resources, credentials, signing keys, federations and user transfers.
Manage organizations, teams, roles, permissions, memberships and role assignments inside one tenant.
Base URLs
| Surface | Base URL | Credential |
|---|---|---|
| OAuth, OIDC and native authentication | exact tenant issuer, for example https://auth.example.com | client contract or end-user token |
| Management API | environment control issuer, for example https://auth.identity.lookandtry.com/identity/admin | control-tenant bearer token |
| Tenant directory API | exact tenant issuer plus /identity/directory | tenant bearer token for the directory resource |
Every code example can be switched between cURL, OkHttp, Retrofit, Axios and Fetch. The selected HTTP client is saved in the browser and applied to every example.
See responses, errors and pagination for the common response contract.