MSU OAuth 2.0 Guide

　 This guide explains how builder apps can use the OAuth 2.0 Authorization Code Grant flow to obtain delegated user authorization and access MSU resources via the OpenAPI. It covers the full token lifecycle: issuance, refresh, introspection, and revocation.

Item	Value
OAuth Server Domain	`https://oauth.msu.io`

Overview

Phase 1. User Authentication & Token Issuance

Authenticate the user via Authorization Code Grant and issue Access Token and Refresh Token.

Phase 2. Token Refresh

Use the Refresh Token to renew an expired Access Token.

Phase 3. Token Introspection

Validate the Access Token and retrieve its metadata.

Phase 4. Token Revocation

Revoke the Refresh Token on logout.

Sequence Diagram

Phase 1 — User Authentication & Token Issuance

User initiates login

The user clicks the login button in the builder app.

Authorization Code request

The builder app redirects to the OAuth server’s authorization endpoint (/oauth/authorize) to obtain an Authorization Code. The request includes the app’s OAuth Client ID and Redirect URI as query parameters.

GET https://oauth.msu.io/oauth/authorize?client_id={CLIENT_ID}&redirect_uri={REDIRECT_URI}

The redirect_uri must exactly match the URI registered with the OAuth client.

Redirect to login page

The OAuth server detects that the user has no valid session and redirects the browser to the login page.

The user’s browser requests the login page from the MSU server following the redirect.

The MSU server serves a wallet address-based login form to the user’s browser.

User logs in

The user submits a login request to the MSU server using their wallet address.

The MSU server processes the login and returns a success response.

Re-request Authorization Code

After login is complete, the builder app re-requests an Authorization Code from the OAuth server.

GET https://oauth.msu.io/oauth/authorize?client_id={CLIENT_ID}&redirect_uri={REDIRECT_URI}

Authorization Code delivered

The OAuth server redirects to the redirect_uri provided in the request, delivering the Authorization Code.

{REDIRECT_URI}?code={AUTHORIZATION_CODE}

Token issuance request

The builder app sends the Authorization Code to the OAuth token endpoint (/oauth/token) with client credentials via HTTP Basic Auth.

POST https://oauth.msu.io/oauth/token
Content-Type: application/x-www-form-urlencoded
Authorization: Basic base64({CLIENT_ID}:{CLIENT_SECRET})

grant_type=authorization_code&code={AUTHORIZATION_CODE}&redirect_uri={REDIRECT_URI}

Access Token & Refresh Token delivered

The OAuth server validates the Authorization Code and client credentials, then issues and returns the tokens.

{
  "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6Im1zdS1vYXV0aCIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 600,
  "refresh_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6Im1zdS1vYXV0aCIsInR5cCI6IkpXVCJ9...",
  "scope": "enhancement"
}

Phase 2 — Token Refresh

Token refresh request

When the Access Token expires, use the Refresh Token to request a new one from the OAuth token endpoint (/oauth/token).

POST https://oauth.msu.io/oauth/token
Content-Type: application/x-www-form-urlencoded
Authorization: Basic base64({CLIENT_ID}:{CLIENT_SECRET})

grant_type=refresh_token&refresh_token={REFRESH_TOKEN}

New Access Token & Refresh Token issued

The OAuth server validates the Refresh Token and issues a new Access Token and Refresh Token.

{
  "access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6Im1zdS1vYXV0aCIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 600,
  "refresh_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6Im1zdS1vYXV0aCIsInR5cCI6IkpXVCJ9...",
  "scope": "enhancement"
}

Phase 3 — Token Introspection

Token introspection request

To verify whether an Access Token is valid, send a request to the OAuth Introspect endpoint (/oauth/introspect).

POST https://oauth.msu.io/oauth/introspect
Content-Type: application/x-www-form-urlencoded
Authorization: Basic base64({CLIENT_ID}:{CLIENT_SECRET})

token={ACCESS_TOKEN}&token_type_hint=access_token

Introspection result returned

The OAuth server returns the validation result along with token metadata such as issuer, expiration, and subject.

{
  "active": true,
  "client_id": "e5451c6e-7bc1-4ec3-bd9c-98c18a7d3290",
  "exp": 1781673359,
  "iat": 1781672759,
  "iss": "NEXPACE",
  "jti": "b8ddec65-3697-441c-a118-fa31a08ccb42",
  "scope": "enhancement",
  "sub": "0x1234567890AbcdEF1234567890aBcdef12345678",
  "token_type": "Bearer"
}

Phase 4 — Token Revocation

Token revocation request

To invalidate a Refresh Token, send a request to the OAuth Revoke endpoint (/oauth/revoke).

POST https://oauth.msu.io/oauth/revoke
Content-Type: application/x-www-form-urlencoded
Authorization: Basic base64({CLIENT_ID}:{CLIENT_SECRET})

token={REFRESH_TOKEN}&token_type_hint=refresh_token

Revocation success response

The OAuth server invalidates the token and returns a success response (200 OK).

For detailed API specifications of each endpoint, refer to the individual pages under the OAuth section. 　

MSU Builder

MSU Resources

MSU OPEN API

Overview

Phase 1. User Authentication & Token Issuance

Phase 2. Token Refresh

Phase 3. Token Introspection

Phase 4. Token Revocation

Sequence Diagram

Phase 1 — User Authentication & Token Issuance

Phase 2 — Token Refresh

Phase 3 — Token Introspection

Phase 4 — Token Revocation

​Overview

Phase 1. User Authentication & Token Issuance

Phase 2. Token Refresh

Phase 3. Token Introspection

Phase 4. Token Revocation

​Sequence Diagram

​Phase 1 — User Authentication & Token Issuance

​Phase 2 — Token Refresh

​Phase 3 — Token Introspection

​Phase 4 — Token Revocation

Overview

Sequence Diagram

Phase 1 — User Authentication & Token Issuance

Phase 2 — Token Refresh

Phase 3 — Token Introspection

Phase 4 — Token Revocation