Endpoints
The endpoints block sets where callers and browsers reach the OAuth server. The OAuth server runs in your Trust Domain Servers, and Defakto publishes this address in the OAuth server's discovery metadata, so that clients such as MCP clients can find its endpoints.
endpoints:
publicBaseURL: https://td-server.defakto.example.com
Fields
| Field | Required | Description | Example |
|---|---|---|---|
publicBaseURL | When you host your own Trust Domain Servers | The address where you host your Trust Domain Servers, as callers and browsers reach it. If Defakto hosts your Trust Domain Servers, leave it out. It must be an https URL. It can be on a public or a private network. It may include a path, but must not end in /oauth. | https://td-server.defakto.example.com |
Derived URLs
Defakto derives three URLs from publicBaseURL:
| URL | Purpose |
|---|---|
<publicBaseURL>/oauth/token | The token endpoint, for every flow |
<publicBaseURL>/oauth/authorize | Where an OAuth client sends a person's browser to sign in |
<publicBaseURL>/oauth/upstream-callback | Where your identity provider sends the browser back after sign-in. |