Leo

Leo for agents

OAuth for client developers

Leo is its own OAuth 2.1 authorisation server for the Agent Platform.

Endpoints

WhatAddress
Metadata (RFC 8414)https://www.leo.co.ke/.well-known/oauth-authorization-server
Authorisationhttps://www.leo.co.ke/oauth/authorize
Tokenhttps://www.leo.co.ke/oauth/token
Registration (RFC 7591)https://www.leo.co.ke/oauth/register
Revocation (RFC 7009)https://www.leo.co.ke/oauth/revoke

Rules

  • Authorisation code with PKCE (S256 only). Public clients; no client secrets are issued.
  • Clients are known by a Client ID Metadata Document (preferred), dynamic registration, or pre-registration.
  • private_key_jwt client authentication is supported against the client's own published keys.
  • Send resource (RFC 8707): https://www.leo.co.ke/mcp or https://www.leo.co.ke/api/agent/v1. Tokens are bound to it and refused elsewhere.
  • Every authorisation response carries iss (RFC 9207).
  • Redirect URIs must be https, or http on a loopback address (any port).
  • Access tokens last an hour. Refresh tokens rotate on every use; presenting a replaced one revokes the grant.
Leo OAuth for client developers | Leo