A hosted OAuth server for your APIs and the apps that call them
An OAuth server, also called an authorization server, issues the access tokens that your APIs accept and the refresh tokens that keep a user signed in. The Skycloak Platform runs one for each of your tenants, following OAuth 2.1, so your team decides what each token may do and the Platform does the issuing, rotating and revoking.
What an OAuth server is responsible for
OAuth separates the service that grants access from the services that are accessed. The OAuth server signs a user in, asks for consent where needed and issues an access token that lists the scopes the client may use. Your APIs only check that token: its signature, its audience, its expiry and its scopes.
That split is what lets a web app, a mobile app and a partner integration all call the same API safely, each with its own client and its own limits, without the API knowing anything about passwords or sessions.
Tokens that stay safe over time
The Platform follows OAuth 2.1, so every client uses the authorization code flow with PKCE and the older implicit and password grants are not offered. Refresh tokens come in two kinds by design: a session refresh token that ends with the browser sign-in session, and an offline refresh token for mobile and long-lived apps that rotates on each use and is revoked if an old one is ever replayed.
Pushed authorization requests, DPoP, which binds a token to the client that holds it, and private key JWT client authentication are on the plan for the first release. Signing keys are rotated by the Platform and published before use, so your APIs keep validating tokens through a key change.
Why not run your own
Open-source OAuth servers are good software, but running one is an operations job: a highly available database, key storage, upgrades when a vulnerability is published, and someone on call when token issuance slows down and every client starts failing at once.
On the Platform that job is Skycloak's. Your tenant runs in the United States or the European Union, and your team works with the standard protocol, which also means you can move to another OAuth server later without rewriting your APIs.
Frequently asked questions
Is an OAuth server the same as an OpenID Connect provider?
Nearly. OpenID Connect adds sign-in and an ID token on top of OAuth. The Platform does both, so the same tenant signs users in and authorizes calls to your APIs.
How do my APIs validate the tokens?
They fetch the tenant's published signing keys once, cache them, and check each access token's signature, audience, expiry and scopes locally.
See the Skycloak Platform for yourself
Book a demo and we will walk you through the Platform with your own sign-in flows in mind.