Flow graphs

QAuth’s flows are written as semantic graphs in delurio’s delurio-graph/0 format (ADR-021). A graph is the specification of a flow: its states, every way it ends, and the guarantees it keeps. delurio renders each one as a page with its diagram, served under /graphs/ (the links are in the list below; the pages are generated at build time, so they are not content pages of this site).

None of these graphs is approved yet. Each one carries a status:

• captured records what QAuth does today;
• proposed is a design under review.

The YAML in graphs/ on GitHub is the source of record. A rendered page is a view of it and says so at its top; read a graph’s status and history on GitHub. The graphs are outside QAuth’s 1.0 stability promise (ADR-021 Decision 6).

All rendered graphs · graphs/ on GitHub ·/llms.txt

Flow	Status	Rendered page	Source of record
Enable and disable an AuthMethod plugin in a realm	captured records what QAuth does today; not approved	Open	graphs/flows/admin/plugin-enable
Verify an account's address after its correct password	proposed a design under review; not approved	Open	graphs/flows/core/account-verification
Authorize a client for the signed-in user	captured records what QAuth does today; not approved	Open	graphs/flows/core/authorization
Tell each app a browser session signed in to that the session ended	proposed a design under review; not approved	Open	graphs/flows/core/backchannel-logout
Ask the signed-in person to allow a client's access, as a step of the Interaction API	proposed a design under review; not approved	Open	graphs/flows/core/consent
Ask the user to approve a client's access	captured records what QAuth does today; not approved	Open	graphs/flows/core/consent-page
Sign the browser out at an app's request, and send it back to the app	proposed a design under review; not approved	Open	graphs/flows/core/logout
Sign out with an access token	captured records what QAuth does today; not approved	Open	graphs/flows/core/logout-token
Sign in with a passkey, prove it on a passkey-bound account, and bind one after a sign-in	proposed a design under review; not approved	Open	graphs/flows/core/passkey
Reset a password, the mailbox first, never past another authenticator	proposed a design under review; not approved	Open	graphs/flows/core/password-reset
Redeem a recovery code in place of a lost factor, and show a new set once	proposed a design under review; not approved	Open	graphs/flows/core/recovery-code
Decide a sign-in, one round at a time	proposed a design under review; not approved	Open	graphs/flows/core/sign-in
Sign in with a password in the browser	captured records what QAuth does today; not approved	Open	graphs/flows/core/sign-in-page
Sign in with a password for tokens	captured records what QAuth does today; not approved	Open	graphs/flows/core/sign-in-token
Register a password account, the mailbox first	proposed a design under review; not approved	Open	graphs/flows/core/sign-up
Sign in, or sign up, through one of the realm's upstream identity providers	proposed a design under review; not approved	Open	graphs/flows/federation/upstream-sign-in
Sign in at an upstream provider through an AuthMethod	proposed a design under review; not approved	Open	graphs/flows/federation/upstream-step

Every rendered page also has its diagram as Mermaid source, at flow.mmd next to the page. The same list, with links for language models, is in /llms.txt.