# Standalone Connect

Standalone Connect allows applications with existing authentication systems to use AuthKit as their OAuth authorization server. Instead of migrating your entire authentication stack, you can leverage WorkOS's OAuth infrastructure while keeping your existing user authentication as the source of truth.

Read more in the [Standalone Connect guide](/authkit/connect/standalone).

### complete

## Complete external authentication

Completes an external authentication flow and returns control to AuthKit. This endpoint is used with [Standalone Connect](/authkit/connect/standalone) to bridge your existing authentication system with the Connect OAuth API infrastructure.

After successfully authenticating a user in your application, calling this endpoint will:

- Create or update the user in AuthKit, using the given `id` as its `external_id`.
- Return a `redirect_uri` your application should redirect to in order for AuthKit to complete the flow

Users are automatically created or updated based on the `id` and `email` provided. If a user with the same `id` exists, their information is updated. Otherwise, a new user is created.

If you provide a new `id` with an `email` that already belongs to an existing user, the request will fail with an error as email addresses are unique to a user.

### metadata

## Metadata

Connect exposes several metadata endpoints in order to be compatible with a wide array of clients that support discovery and automatic configuration.

### openid-configuration

### OpenID configuration

This discovery endpoint provides the standard configuration for OpenID clients to interact with WorkOS Connect.

### oauth-authorization-server

### OAuth Authorization Server

This endpoint provides [RFC 6749](https://datatracker.ietf.org/doc/html/rfc6749)-compatible OAuth Authorization Server metadata.

Model Context Protocol (MCP) clients that support the latest version of the specification use this endpoint. [Read more here](/authkit/mcp) about how to use AuthKit as an authorization server for an MCP server.

### introspection

## Token introspection

Indicates whether the given token (access token or refresh token) is valid and active. Additionally, it provides details about the token.

This endpoint is authenticated by provided the WorkOS Application’s client ID and client secret in the body of the request.

### CLI Auth