> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usehasp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# OAuth FAQ

> Common questions about HASP's OAuth 2.1 implementation.

## What scopes does HASP support?

HASP uses Rich Authorization Requests (RFC 9396) instead of traditional OAuth scopes. Permissions are declared as structured `authorization_details` objects in the authorization URL. See [Consent Screen](/platform/oauth/consent-screen) for the supported types.

## How long do access tokens last?

The credential lifetime is determined by the authorized agent's expiry policy (`default_expiry_hours`). The `expires_in` field in the token response gives the exact lifetime in seconds.

## Does HASP support refresh tokens?

No. When an access token expires, the user must re-authorize. This is intentional — agent credentials are short-lived by design to limit the blast radius of a leaked token.

## Can I use client credentials grant?

No. HASP's OAuth endpoint supports only the **authorization code grant** with PKCE. Unattended server-to-server access uses API keys, not OAuth.

## My client secret is lost — what do I do?

Rotate it immediately from Developer Console → Applications → (your app) → Rotate client secret. You can set a grace period (up to 24 hours). The grace period keeps the old client secret valid for client authentication during migration. Already-issued access tokens are independent of the client secret and remain active until they expire or are explicitly revoked.

## What happens when I revoke an application?

All credentials issued via the application are revoked immediately. Users that previously authorized your application will need to re-authorize if the application is re-registered. The revocation is permanent — revoked applications cannot be restored.

## Can I restrict which agents can authorize?

The authorization request is scoped to the `agent_id` parameter you include in the authorization URL. The consent screen displays that specific agent — there is no user-selectable agent list. Specify a different `agent_id` in your authorization URL to delegate to a different agent.

## Where are the OAuth discovery endpoints?

```
GET /.well-known/oauth-authorization-server
GET /v1/oauth/authorize
POST /v1/oauth/token
POST /v1/oauth/introspect
```

The metadata document at `/.well-known/oauth-authorization-server` is the RFC 8414 server metadata document and lists all supported endpoints, grant types, and PKCE methods.

## Do test-mode applications use different endpoints?

No — the endpoints are the same. Test-mode applications issue test-mode credentials (`hasp_agt_test_` prefix) that are isolated from live data.

## Is there a rate limit on the token endpoint?

Yes. The token endpoint is rate-limited per `client_id`. Exceeding the limit returns `429 Too Many Requests` with a `Retry-After` header.

## My authorization request is being rejected with `invalid_request`

Common causes:

* `code_challenge_method` is not `S256` (plain is not supported)
* `redirect_uri` does not exactly match one registered on the application
* `code_challenge` is missing or malformed
* `client_id` does not match an active application