# description
Document served at /.well-known/ppx-card.json advertising a provider's PPX capability.

# properties.auth.properties.consent_endpoint.description
OPTIONAL. Where the provider serves its consent screen, as a URI template containing {grant_request_id}. The consent UI need not share an origin with the API - the reference provider serves them on different ports - so a client cannot reliably derive this from base_url. When absent, a client MUST use the consent_url returned by POST /v1/consent/request.

# properties.signing.properties.grant_jwks_uri.description
URL of the provider's grant-signing public keys in JWKS format. Third parties verify grant-scoped tokens against these keys without calling the provider API. Stable across deploys; changes only on key rotation (which adds a new kid to the JWKS document).