Build your OpenID Connect integration with confidence.

Begin with the discovery document. It is the canonical source for issuer metadata, endpoints, supported scopes, signing algorithms, and client authentication methods.

GET /default/.well-known/openid-configuration

Store one JSON document per application in the configured applications directory. Changes are validated and activated atomically; an invalid edit leaves the last valid revision running.

{
  "schema_version": 1,
  "kind": "oidc_application",
  "id": "example",
  "name": "Example application",
  "type": "public",
  "redirect_uris": ["https://app.example.com/oidc/callback"],
  "scopes": ["openid", "profile", "email"],
  "grant_types": ["authorization_code"],
  "authentication_method": "none",
  "pkce_required": true,
  "nonce_required": true
}

Confidential applications may use client_secret_basic or client_secret_post. A secret can be a literal string or an environment reference. Keep examples separate from production application files.

1. 1
   Create a verifier

   Generate a high-entropy code verifier and derive its S256 challenge.

2. 2
   Send the browser to authorize

   Include client ID, exact redirect URI, scope, state, nonce, and the PKCE challenge.

3. 3
   Exchange the code

   POST the short-lived code and original verifier to the token endpoint.

4. 4
   Validate the ID token

   Verify its RS256 signature through JWKS, then issuer, audience, expiry, and nonce.

GET /default/authorize
  ?response_type=code
  &client_id=example
  &redirect_uri=https%3A%2F%2Fapp.example.com%2Foidc%2Fcallback
  &scope=openid%20profile%20email
  &state=opaque-client-state
  &nonce=unique-login-nonce
  &code_challenge=BASE64URL_SHA256_VERIFIER
  &code_challenge_method=S256