Authly now ships a full developer platform. Any client — including our own — authenticates against the website and never talks to the storage layer directly.
What shipped
- OAuth 2.1 authorization code flow with mandatory PKCE (S256).
- A consent screen at /oauth/authorize showing the exact scopes requested.
- Token exchange, refresh with rotation, and revocation endpoints.
- An OpenID Connect discovery document for automatic client configuration.
- A sync API for accounts, categories and settings, plus device management.
Manage your apps
Head to Settings → Developer applications to register an app, view connected clients, rotate credentials and inspect recent authorization activity.