Implement an RFC-compliant OAuth 2.1 authorization server in Rails applications. Use when building apps that need to authorize third-party clients (like MCP clients, API consumers, or external integrations) using industry-standard OAuth flows with PKCE, dynamic client registration, and token management.
Build a complete RFC-compliant OAuth 2.1 authorization server enabling your Rails app to:
| Goal | Start With |
|---|---|
| Basic OAuth provider | Core Implementation |
| PKCE for public clients | PKCE Flow |
| Client registration | Client Management |
| Token lifecycle | Token Service |
| Monitoring & audit | Monitoring |
┌─────────────────────────────────────────────────────────────┐
│ OAuth 2.1 Provider │
├─────────────────────────────────────────────────────────────┤
│ Discovery Layer │
│ ┌─────────────────────────────────────────────────────────┐ │
│ │ GET /.well-known/oauth-authorization-server │ │
│ │ Returns: issuer, authorization_endpoint, token_endpoint │ │
│ └─────────────────────────────────────────────────────────┘ │
│ │
│ Authorization Layer │
│ ┌─────────────────────┐ ┌─────────────────────┐ │
│ │ /oauth/authorize │ │ /oauth/token │ │
│ │ - Consent screen │ │ - client_credentials│ │
│ │ - PKCE validation │ │ - authorization_code│ │
│ │ - Code issuance │ │ - refresh_token │ │
│ └─────────────────────┘ └─────────────────────┘ │
│ │
│ Client Layer │
│ ┌─────────────────────┐ ┌─────────────────────┐ │
│ │ /oauth/register │ │ OAuthClient │ │
│ │ - Dynamic DCR │ │ OAuthAccessToken │ │
│ │ - RFC 7591 │ │ OAuthAuthorizationCode│ │
│ └─────────────────────┘ └─────────────────────┘ │
└─────────────────────────────────────────────────────────────┘
app/
├── controllers/
│ └── oauth_controller.rb # Main OAuth endpoints
├── models/
│ ├── oauth_client.rb # Client registration
│ ├── oauth_access_token.rb # Bearer tokens
│ ├── oauth_authorization_code.rb # Auth codes with PKCE
│ ├── oauth_refresh_token.rb # Refresh tokens
│ └── oauth_event.rb # Audit logging
├── services/
│ ├── token_service.rb # Token issuance/validation
│ ├── client_registration_service.rb # Dynamic registration
│ ├── p_k_c_e_service.rb # PKCE handling
│ └── oauth_monitoring_service.rb # Stats and cleanup
├── views/
│ └── oauth/
│ └── authorize.html.erb # Consent screen
└── concerns/
├── oauth_authentication.rb # Auth concern
└── oauth_cors.rb # CORS handling
config/
├── initializers/
│ └── oauth_security.rb # Security config
└── oauth_security.yml # Security settings
db/migrate/
├── create_oauth_clients.rb
├── create_oauth_access_tokens.rb
├── create_oauth_authorization_codes.rb
└── create_oauth_events.rb
When implementation is complete, verify:
GET /.well-known/oauth-authorization-server returns RFC 8414 metadataissuer, authorization_endpoint, token_endpoint, registration_endpointgrant_types_supported, response_types_supported, scopes_supportedPOST /oauth/register supports dynamic client registration (RFC 7591)GET /oauth/authorize renders consent screen for logged-in usersPOST /oauth/token handles authorization_code grant with PKCE verificationPOST /oauth/token handles client_credentials grant for confidential clientssecure_comparesecure_compare for token comparisonencrypts declaration#)/.well-known/oauth-authorization-server returns valid JSON