Loading…
OpenID Connect and OAuth 2.0 endpoints served by oidc-provider at http://localhost:3000.
The standard OpenID Connect Discovery document is available at http://localhost:3000/.well-known/openid-configuration. It advertises all supported endpoints, scopes, claims, and signing algorithms.
| Method | Path | Description |
|---|---|---|
| GET | /.well-known/openid-configuration | OIDC discovery metadata |
| GET | /jwks | JSON Web Key Set for token verification (RS256 public keys) |
| Method | Path | Auth | Description |
|---|---|---|---|
| GET | /auth | Browser redirect | Authorization endpoint. Starts the OIDC flow. Supports response_type=code (authorization code flow). |
| POST | /token | Client credentials | Token endpoint. Exchanges authorization codes for tokens. Also supports refresh_token grant for token refresh. |
| GET | /me | Bearer access token | Returns user identity claims based on the access token scope. |
| POST | /revoke | Client credentials | End-session (front-channel logout) |
| POST | /request | Client credentials | Pushed Authorization Request (PAR) endpoint. |
A development client is hardcoded in src/lib/oauth2/provider.ts:
| Field | Value |
|---|---|
| client_id | default_client |
| client_secret | default_secret_change_me |
| client_type | confidential |
| redirect_uris | http://localhost:3000/callback |
| grant_types / response_types | authorization_code, refresh_token / code |
| allowed_scopes | openid, profile, email, offline_access |
Additional clients are registered dynamically at runtime via the Clients API, loaded from the database through findClient().
clientCredentials.enabled is set to false. Machine-to-machine access should use the authorization code flow with a service account instead.features.introspection.enabled and features.revocation.enabled in provider.ts, they are served at /token/introspection and /token/revocation respectively.