Session InspectorBBC partner APIs · device vs user tokens

How BBC talks to LoginRadius

Load a live TV session_id to replay every partner → CIAM call for that set. Then compare the device token and the user token — isolation is sub, not a second tenant.

Integration map

These are the LoginRadius APIs a BBC partner backend calls. The TV never sees them.

POST /api/oidc/{app}/register

Closed DCR — mint a per-TV husk with software_id.

POST /api/oidc/{app}/par

Pushed authorization request (scope=openid device).

POST /api/oidc/{app}/authorize/device

Issue the device authorization code (Journey A).

POST /api/oidc/{app}/token

authorization_code → device access token.

POST /api/oidc/{app}/device/code

RFC 8628 user_code shown on the TV.

POST /api/oidc/{app}/token (device_code)

Partner polls until the companion user approves.

GET /api/oidc/{app}/associations

Users who consented on this husk.

Identity /identity/v2/auth/customobject

BBC AssociatedDevices mapping. Not a JWT claim.

POST /api/oidc/{app}/revoke

Stolen-TV kill of the device refresh token.

GET …/jwks

bbc-api verifies the device AT locally. No CIAM RPS on home.

Load a session