Welcome
To join our community, please login or register!
Login Register
Internet Explorer
Internet Explorer is not supported. Please upgrade to a more modern browser.

OAuth2 and OIDC Service Supplemental Terms

Last Updated: 12 July 2025

1. OAuth2 and OIDC Service Definitions

OAuth2 Service means the OAuth 2.0 authorization framework implementation provided by Spooky Services that enables third-party applications to obtain limited access to user accounts.

OIDC Service means the OpenID Connect service that provides an identity layer on top of OAuth 2.0, enabling clients to verify user identity and obtain basic profile information.

Authorization Server means the server component that issues access tokens to client applications after successfully authenticating the resource owner.

Client Application means any third-party application that uses Spooky Services' OAuth2 or OIDC services to authenticate users or access protected resources.

2. Client Registration and Management

  • All client applications must register with Spooky Services before using OAuth2 or OIDC services.

  • Registration requires providing accurate information about the application, including one redirect URI, application type, and intended use cases.

  • Each client application may register only one redirect URI, which must use HTTPS and be as specific as possible.

  • Each client application will receive unique client credentials (client ID and client secret) that must be kept confidential and secure. Client secrets are mandatory for all client applications.

  • Clients are responsible for:

    • Maintaining the confidentiality of client credentials

    • Implementing appropriate security measures to prevent unauthorized access

    • Immediately notifying Spooky Services of any suspected credential compromise

3. Security Requirements and Compliance

  • All OAuth2 and OIDC communications must use TLS 1.2 or higher. Client applications must implement proper certificate validation and not bypass security warnings.

  • The state parameter is optional but recommended for CSRF protection in authorization requests. When provided by the client, Spooky Services will return it unchanged in the authorization response.

  • Access tokens must be stored securely and transmitted only over encrypted connections.

  • Refresh tokens, where provided, must be stored with enhanced security measures.

  • Tokens must not be exposed in client-side code or logs.

  • Clients must implement proper token revocation procedures.

  • Spooky Services endeavors to protect user data and implement reasonable security measures. We do our best to protect the security and privacy of user data within our technical capabilities.

4. JWT Token Validation

  • All JWT tokens issued by Spooky Services must be properly validated by client applications, including verification of issuer, audience, and expiration claims.

  • Client applications must verify the JWT signature using the public key obtained from the JSON Web Key Set (JWKS) URI. The API documentation at https://api.spookysrv.com provides a link to the JWKS URI where the contents are based on the signing public key.

  • Required validation steps:

    • Verify the JWT signature using the public key from the JWKS URI referenced in the API documentation

    • Validate the issuer (iss) claim

    • Validate the audience (aud) claim

    • Check the expiration time (exp) claim

    • All validation methods listed in the API documentation

    • Verify other standard JWT claims as appropriate

5. Service Availability and Limitations

  • While Spooky Services strives to maintain high availability, we do not guarantee uninterrupted service or reliability. Services may be unavailable due to maintenance, technical issues, or other factors beyond our control.

  • OAuth2 and OIDC services are subject to rate limiting to prevent abuse and ensure fair usage. Clients exceeding rate limits may experience temporary service restrictions.

  • Spooky Services may modify, update, or discontinue OAuth2 and OIDC services with or without notice. Critical security updates may be implemented without prior notice.

6. Liability and Disclaimers

  • The OAuth2 and OIDC services are provided "as is" without warranties of any kind, express or implied. Spooky Services does not warrant that the services will be error-free, secure, reliable, or continuously available.

  • Spooky Services bears no liability under any circumstances for any damages, losses, or issues arising from the use of OAuth2 and OIDC services. This includes but is not limited to:

    • Service interruptions, downtime, or unreliability

    • Security breaches or vulnerabilities

    • Data loss, corruption, or unauthorized access

    • Third-party integrations or dependencies

    • Any direct, indirect, incidental, or consequential damages

  • Client applications agree to indemnify Spooky Services against all claims, damages, and expenses arising from their use of OAuth2 and OIDC services.

7. Incident Response and Security

  • Spooky Services monitors OAuth2 and OIDC services for security threats and compliance violations. Suspicious activities may result in temporary service suspension.

  • In the event of a security incident, Spooky Services may notify affected parties at our sole discretion. Such notification is not guaranteed and depends on the nature and severity of the incident.

  • Security vulnerabilities may be reported through our security disclosure process, which can be found at the standard security.txt location (/.well-known/security.txt).

8. Termination and Suspension

  • Spooky Services may terminate or suspend OAuth2 and OIDC services for any reason or without any reason at our sole discretion. This includes termination for violations of these terms, security concerns, or any other circumstances deemed appropriate by Spooky Services.

  • Termination may occur without prior notice and may be immediate depending on the circumstances.

  • Upon service termination, data handling will be conducted in accordance with our capabilities and applicable legal requirements.

9. Updates and Modifications

  • Spooky Services may update these OAuth2 and OIDC additional terms at any time, and any updates may be made without notice.

  • Users may not be notified for any terms update.

  • Breaking changes will be announced via the General Announcements category in the forum. Individual user notifications are not provided, and users are responsible for staying informed about changes to these terms.

  • Continued use of OAuth2 and OIDC services after changes constitute acceptance of the updated terms.

10. Contact Information

  • For questions or concerns regarding OAuth2 and OIDC services, please contact Spooky Services through our designated support channels.

  • Security-related issues should be reported through our security disclosure process located at https://hub.spookysrv.com/.well-known/security.txt.

11. Scope and Claims Management

  • Client applications must request only the minimum scopes necessary for their functionality. Excessive scope requests may result in service restrictions or termination.

  • Spooky Services reserves the right to limit or modify granted scopes based on security assessments and operational requirements.

  • JWT claims are processed according to standard specifications, with signature verification required using the public key available through the JWKS URI referenced in the API documentation at https://api.spookysrv.com.

Note: This document supplements and does not replace your main Terms and Conditions. In case of conflicts, these OAuth2 and OIDC specific terms take precedence for matters related to identity and authentication services.