OIDC Discovery

Autentico serves the OIDC discovery document at:

GET /.well-known/openid-configuration
GET /oauth2/.well-known/openid-configuration

Both paths return the same document. Most OIDC client libraries accept this URL and auto-configure themselves from it.

Discovery document

{
  "issuer": "https://auth.example.com/oauth2",
  "authorization_endpoint": "https://auth.example.com/oauth2/authorize",
  "token_endpoint": "https://auth.example.com/oauth2/token",
  "userinfo_endpoint": "https://auth.example.com/oauth2/userinfo",
  "registration_endpoint": "https://auth.example.com/oauth2/register",
  "end_session_endpoint": "https://auth.example.com/oauth2/logout",
  "jwks_uri": "https://auth.example.com/oauth2/.well-known/jwks.json",
  "response_types_supported": ["code"],
  "response_modes_supported": ["query"],
  "subject_types_supported": ["public"],
  "id_token_signing_alg_values_supported": ["RS256"],
  "scopes_supported": ["openid", "profile", "email", "address", "phone", "offline_access", "groups"],
  "token_endpoint_auth_methods_supported": ["client_secret_basic", "client_secret_post"],
  "request_parameter_supported": false,
  "request_uri_parameter_supported": false,
  "claims_supported": [
    "sub", "iss", "aud", "exp", "iat", "auth_time", "nonce", "sid", "acr",
    "name", "preferred_username", "given_name", "family_name", "middle_name",
    "nickname", "profile", "picture", "website", "gender", "birthdate",
    "locale", "zoneinfo", "updated_at",
    "email", "email_verified",
    "phone_number",
    "address",
    "groups"
  ]
}

code_challenge_methods_supported is ["S256"] by default. When pkce_enforce_s256 is disabled, it becomes ["S256", "plain"]. Clients should always send an explicit code_challenge_method=S256; an omitted method defaults to plain.

Response modes

response_modes_supported is explicitly ["query"]. Authorization results use the callback query string. Omitted, empty or explicit query modes are accepted; unsupported modes such as fragment and form_post return invalid_request before login or SSO.

Request objects

Autentico does not support request objects through request or request_uri. Discovery explicitly sets request_uri_parameter_supported to false, because omitting it would imply support (OIDC Discovery §3).

A nonempty request_uri at /authorize returns request_uri_not_supported to the registered callback before login or SSO; it is never fetched. An empty value is treated as omitted. Send authorization parameters directly instead. A nonempty request continues to return request_not_supported.

JWKS endpoint

The JSON Web Key Set (public keys for token verification) is at:

GET /oauth2/.well-known/jwks.json

{
  "keys": [
    {
      "kty": "RSA",
      "kid": "autentico-key-1",
      "use": "sig",
      "alg": "RS256",
      "n": "...",
      "e": "AQAB"
    }
  ]
}

The kid value is configurable via AUTENTICO_JWK_CERT_KEY_ID (default: autentico-key-1). Client libraries use this to look up the right key when verifying tokens.

Configuring an OIDC client library

Most OIDC libraries accept a single discovery URL:

https://auth.example.com/oauth2/.well-known/openid-configuration

The library fetches this document, extracts the endpoint URLs, and uses them for all subsequent requests. No manual endpoint configuration is needed.

See Connecting an OIDC Client for framework-specific examples.