{
  "info": {
    "name": "MemoID OAuth 2.0 / OpenID Connect",
    "description": "Public MemoID integration examples. Browser authorization still uses the normal sign-in and consent redirect flow. Never store a production Client Secret or refresh token in a shared collection.",
    "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json"
  },
  "variable": [
    {"key":"issuer","value":"https://id.memolab.me"},
    {"key":"client_id","value":"YOUR_CLIENT_ID"},
    {"key":"client_secret","value":"YOUR_CLIENT_SECRET"},
    {"key":"redirect_uri","value":"https://your-app.example.com/auth/callback"},
    {"key":"access_token","value":""},
    {"key":"refresh_token","value":""},
    {"key":"code","value":""},
    {"key":"code_verifier","value":""}
  ],
  "item": [
    {
      "name": "Discovery",
      "item": [
        {"name":"OpenID Configuration","request":{"method":"GET","url":"{{issuer}}/.well-known/openid-configuration"}},
        {"name":"JWKS","request":{"method":"GET","url":"{{issuer}}/.well-known/jwks.json"}}
      ]
    },
    {
      "name": "OAuth / OIDC",
      "item": [
        {
          "name":"Token — Authorization Code + PKCE",
          "request":{
            "method":"POST",
            "header":[{"key":"Content-Type","value":"application/x-www-form-urlencoded"}],
            "body":{"mode":"urlencoded","urlencoded":[
              {"key":"grant_type","value":"authorization_code"},
              {"key":"code","value":"{{code}}"},
              {"key":"redirect_uri","value":"{{redirect_uri}}"},
              {"key":"client_id","value":"{{client_id}}"},
              {"key":"code_verifier","value":"{{code_verifier}}"}
            ]},
            "url":"{{issuer}}/oauth/token",
            "description":"Exchange the one-time authorization code. Confidential clients must also use the client authentication method configured for the application."
          }
        },
        {
          "name":"Token — Refresh Token",
          "request":{
            "method":"POST",
            "header":[{"key":"Content-Type","value":"application/x-www-form-urlencoded"}],
            "body":{"mode":"urlencoded","urlencoded":[
              {"key":"grant_type","value":"refresh_token"},
              {"key":"refresh_token","value":"{{refresh_token}}"},
              {"key":"client_id","value":"{{client_id}}"}
            ]},
            "url":"{{issuer}}/oauth/token"
          }
        },
        {
          "name":"UserInfo",
          "request":{
            "method":"GET",
            "header":[{"key":"Authorization","value":"Bearer {{access_token}}","type":"text"}],
            "url":"{{issuer}}/oauth/userinfo"
          }
        },
        {
          "name":"Revoke Token",
          "request":{
            "method":"POST",
            "header":[{"key":"Content-Type","value":"application/x-www-form-urlencoded"}],
            "body":{"mode":"urlencoded","urlencoded":[
              {"key":"token","value":"{{refresh_token}}"},
              {"key":"token_type_hint","value":"refresh_token"}
            ]},
            "url":"{{issuer}}/oauth/revoke"
          }
        }
      ]
    }
  ]
}