OpenID Connect discovery document

GET/.well-known/openid-configuration

Returns the issuer's OpenID Provider Metadata (OIDC Discovery 1.0), a superset of the RFC 8414 authorization-server metadata. Cacheable (Cache-Control: public, max-age=300).

GET/.well-known/openid-configuration

curl 'https://auth.example.com/.well-known/openid-configuration'

Response

200 OK

{
  "issuer": "https://auth.example.com",
  "authorization_endpoint": "https://auth.example.com/authorize",
  "token_endpoint": "https://auth.example.com/token",
  "userinfo_endpoint": "https://auth.example.com/userinfo",
  "jwks_uri": "https://auth.example.com/.well-known/jwks.json",
  "registration_endpoint": "https://auth.example.com/register",
  "introspection_endpoint": "https://auth.example.com/introspect",
  "revocation_endpoint": "https://auth.example.com/revoke",
  "device_authorization_endpoint": "https://auth.example.com/device_authorization",
  "pushed_authorization_request_endpoint": "https://auth.example.com/par",
  "end_session_endpoint": "https://auth.example.com/end_session",
  "response_types_supported": [
    "code"
  ],
  "response_modes_supported": [
    "query",
    "fragment",
    "form_post"
  ],
  "subject_types_supported": [
    "public"
  ],
  "id_token_signing_alg_values_supported": [
    "ES256"
  ],
  "scopes_supported": [
    "openid",
    "profile",
    "email",
    "offline_access"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "none",
    "private_key_jwt"
  ],
  "grant_types_supported": [
    "authorization_code",
    "refresh_token",
    "client_credentials",
    "urn:ietf:params:oauth:grant-type:device_code",
    "urn:ietf:params:oauth:grant-type:token-exchange"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ],
  "dpop_signing_alg_values_supported": [
    "ES256"
  ],
  "authorization_response_iss_parameter_supported": true,
  "require_pushed_authorization_requests": false
}

Authorization

None. This endpoint does not take API credentials.

Responses

200 OKapplication/jsonDiscovery metadata.
Discovery metadata.
Body
OAuth 2.0 Authorization Server Metadata (RFC 8414) unified with OpenID Provider Metadata (OIDC Discovery 1.0). Serves both discovery documents.
- issuerstring · urirequired
  The issuer identifier (an https URL, no query/fragment/trailing slash).
  Example"https://auth.example.com"
- authorization_endpointstring · urirequired
  Example"https://auth.example.com/authorize"
- token_endpointstring · urirequired
  Example"https://auth.example.com/token"
- jwks_uristring · urirequired
  Example"https://auth.example.com/.well-known/jwks.json"
- response_types_supportedarray of stringsrequired
  Example["code"]
- subject_types_supportedarray of stringsrequired
  Example["public"]
- id_token_signing_alg_values_supportedarray of stringsrequired
  Example["ES256"]
- userinfo_endpointstring · uri
  Example"https://auth.example.com/userinfo"
- registration_endpointstring · uri
  Example"https://auth.example.com/register"
- introspection_endpointstring · uri
  Example"https://auth.example.com/introspect"
- revocation_endpointstring · uri
  Example"https://auth.example.com/revoke"
- device_authorization_endpointstring · uri
  Example"https://auth.example.com/device_authorization"
- pushed_authorization_request_endpointstring · uri
  Example"https://auth.example.com/par"
- end_session_endpointstring · uri
  Example"https://auth.example.com/end_session"
- check_session_iframestring · uri
  Example"https://auth.example.com/check_session_iframe"
- scopes_supportedarray of strings
  A JSON array of strings.
- response_modes_supportedarray of strings
  A JSON array of strings.
- grant_types_supportedarray of strings
  A JSON array of strings.
- userinfo_signing_alg_values_supportedarray of strings
  A JSON array of strings.
- request_object_signing_alg_values_supportedarray of strings
  A JSON array of strings.
- token_endpoint_auth_methods_supportedarray of strings
  A JSON array of strings.
- token_endpoint_auth_signing_alg_values_supportedarray of strings
  A JSON array of strings.
- revocation_endpoint_auth_methods_supportedarray of strings
  A JSON array of strings.
- revocation_endpoint_auth_signing_alg_values_supportedarray of strings
  A JSON array of strings.
- introspection_endpoint_auth_methods_supportedarray of strings
  A JSON array of strings.
- introspection_endpoint_auth_signing_alg_values_supportedarray of strings
  A JSON array of strings.
- code_challenge_methods_supportedarray of strings
  A JSON array of strings.
- dpop_signing_alg_values_supportedarray of strings
  A JSON array of strings.
- authorization_details_types_supportedarray of strings
  A JSON array of strings.
- claims_supportedarray of strings
  A JSON array of strings.
- ui_locales_supportedarray of strings
  A JSON array of strings.
- acr_values_supportedarray of strings
  A JSON array of strings.
- claims_parameter_supportedboolean
  Examplefalse
- request_parameter_supportedboolean
  Examplefalse
- request_uri_parameter_supportedboolean
  Exampletrue
- require_pushed_authorization_requestsboolean
  Examplefalse
- authorization_response_iss_parameter_supportedboolean
  Exampletrue
- tls_client_certificate_bound_access_tokensboolean
  Examplefalse
- backchannel_logout_supportedboolean
  Examplefalse
- backchannel_logout_session_supportedboolean
  Examplefalse
- frontchannel_logout_supportedboolean
  Examplefalse
- frontchannel_logout_session_supportedboolean
  Examplefalse
- service_documentationstring · uri
- op_policy_uristring · uri
- op_tos_uristring · uri

PreviousDiscovery NextOAuth 2.0 Authorization Server Metadata

OpenID Connect discovery document

GET/.well-known/openid-configuration

No credentialsCached for 5 min

Returns the issuer's OpenID Provider Metadata (OIDC Discovery 1.0), a superset of the RFC 8414 authorization-server metadata. Cacheable (Cache-Control: public, max-age=300).

GET/.well-known/openid-configuration

curl 'https://auth.example.com/.well-known/openid-configuration'

Response

200 OK

{
  "issuer": "https://auth.example.com",
  "authorization_endpoint": "https://auth.example.com/authorize",
  "token_endpoint": "https://auth.example.com/token",
  "userinfo_endpoint": "https://auth.example.com/userinfo",
  "jwks_uri": "https://auth.example.com/.well-known/jwks.json",
  "registration_endpoint": "https://auth.example.com/register",
  "introspection_endpoint": "https://auth.example.com/introspect",
  "revocation_endpoint": "https://auth.example.com/revoke",
  "device_authorization_endpoint": "https://auth.example.com/device_authorization",
  "pushed_authorization_request_endpoint": "https://auth.example.com/par",
  "end_session_endpoint": "https://auth.example.com/end_session",
  "response_types_supported": [
    "code"
  ],
  "response_modes_supported": [
    "query",
    "fragment",
    "form_post"
  ],
  "subject_types_supported": [
    "public"
  ],
  "id_token_signing_alg_values_supported": [
    "ES256"
  ],
  "scopes_supported": [
    "openid",
    "profile",
    "email",
    "offline_access"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "none",
    "private_key_jwt"
  ],
  "grant_types_supported": [
    "authorization_code",
    "refresh_token",
    "client_credentials",
    "urn:ietf:params:oauth:grant-type:device_code",
    "urn:ietf:params:oauth:grant-type:token-exchange"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ],
  "dpop_signing_alg_values_supported": [
    "ES256"
  ],
  "authorization_response_iss_parameter_supported": true,
  "require_pushed_authorization_requests": false
}

Authorization

None. This endpoint does not take API credentials.

Responses

200 OKapplication/jsonDiscovery metadata.
Discovery metadata.
Body
OAuth 2.0 Authorization Server Metadata (RFC 8414) unified with OpenID Provider Metadata (OIDC Discovery 1.0). Serves both discovery documents.
- issuerstring · urirequired
  The issuer identifier (an https URL, no query/fragment/trailing slash).
  Example"https://auth.example.com"
- authorization_endpointstring · urirequired
  Example"https://auth.example.com/authorize"
- token_endpointstring · urirequired
  Example"https://auth.example.com/token"
- jwks_uristring · urirequired
  Example"https://auth.example.com/.well-known/jwks.json"
- response_types_supportedarray of stringsrequired
  Example["code"]
- subject_types_supportedarray of stringsrequired
  Example["public"]
- id_token_signing_alg_values_supportedarray of stringsrequired
  Example["ES256"]
- userinfo_endpointstring · uri
  Example"https://auth.example.com/userinfo"
- registration_endpointstring · uri
  Example"https://auth.example.com/register"
- introspection_endpointstring · uri
  Example"https://auth.example.com/introspect"
- revocation_endpointstring · uri
  Example"https://auth.example.com/revoke"
- device_authorization_endpointstring · uri
  Example"https://auth.example.com/device_authorization"
- pushed_authorization_request_endpointstring · uri
  Example"https://auth.example.com/par"
- end_session_endpointstring · uri
  Example"https://auth.example.com/end_session"
- check_session_iframestring · uri
  Example"https://auth.example.com/check_session_iframe"
- scopes_supportedarray of strings
  A JSON array of strings.
- response_modes_supportedarray of strings
  A JSON array of strings.
- grant_types_supportedarray of strings
  A JSON array of strings.
- userinfo_signing_alg_values_supportedarray of strings
  A JSON array of strings.
- request_object_signing_alg_values_supportedarray of strings
  A JSON array of strings.
- token_endpoint_auth_methods_supportedarray of strings
  A JSON array of strings.
- token_endpoint_auth_signing_alg_values_supportedarray of strings
  A JSON array of strings.
- revocation_endpoint_auth_methods_supportedarray of strings
  A JSON array of strings.
- revocation_endpoint_auth_signing_alg_values_supportedarray of strings
  A JSON array of strings.
- introspection_endpoint_auth_methods_supportedarray of strings
  A JSON array of strings.
- introspection_endpoint_auth_signing_alg_values_supportedarray of strings
  A JSON array of strings.
- code_challenge_methods_supportedarray of strings
  A JSON array of strings.
- dpop_signing_alg_values_supportedarray of strings
  A JSON array of strings.
- authorization_details_types_supportedarray of strings
  A JSON array of strings.
- claims_supportedarray of strings
  A JSON array of strings.
- ui_locales_supportedarray of strings
  A JSON array of strings.
- acr_values_supportedarray of strings
  A JSON array of strings.
- claims_parameter_supportedboolean
  Examplefalse
- request_parameter_supportedboolean
  Examplefalse
- request_uri_parameter_supportedboolean
  Exampletrue
- require_pushed_authorization_requestsboolean
  Examplefalse
- authorization_response_iss_parameter_supportedboolean
  Exampletrue
- tls_client_certificate_bound_access_tokensboolean
  Examplefalse
- backchannel_logout_supportedboolean
  Examplefalse
- backchannel_logout_session_supportedboolean
  Examplefalse
- frontchannel_logout_supportedboolean
  Examplefalse
- frontchannel_logout_session_supportedboolean
  Examplefalse
- service_documentationstring · uri
- op_policy_uristring · uri
- op_tos_uristring · uri

PreviousDiscovery NextOAuth 2.0 Authorization Server Metadata

Authorization

Responses

Body

Authorization

Responses

Body