# OpenID Connect discovery document

`GET /.well-known/openid-configuration`

Returns the issuer's OpenID Provider Metadata (OIDC Discovery 1.0), a
superset of the RFC 8414 authorization-server metadata. Cacheable
(`Cache-Control: public, max-age=300`).

## Authorization

None: this endpoint does not take API credentials.

Responses may be cached for 5 minutes.

## Responses

### 200 OK

Discovery metadata.

Content type: `application/json`

OAuth 2.0 Authorization Server Metadata (RFC 8414) unified with OpenID Provider Metadata (OIDC Discovery 1.0). Serves both discovery documents.

- `issuer` (string (uri), required): The issuer identifier (an https URL, no query/fragment/trailing slash). Example: `"https://auth.example.com"`.
- `authorization_endpoint` (string (uri), required): Example: `"https://auth.example.com/authorize"`.
- `token_endpoint` (string (uri), required): Example: `"https://auth.example.com/token"`.
- `jwks_uri` (string (uri), required): Example: `"https://auth.example.com/.well-known/jwks.json"`.
- `response_types_supported` (array of strings, required): Example: `["code"]`.
- `subject_types_supported` (array of strings, required): Example: `["public"]`.
- `id_token_signing_alg_values_supported` (array of strings, required): Example: `["ES256"]`.
- `userinfo_endpoint` (string (uri), optional): Example: `"https://auth.example.com/userinfo"`.
- `registration_endpoint` (string (uri), optional): Example: `"https://auth.example.com/register"`.
- `introspection_endpoint` (string (uri), optional): Example: `"https://auth.example.com/introspect"`.
- `revocation_endpoint` (string (uri), optional): Example: `"https://auth.example.com/revoke"`.
- `device_authorization_endpoint` (string (uri), optional): Example: `"https://auth.example.com/device_authorization"`.
- `pushed_authorization_request_endpoint` (string (uri), optional): Example: `"https://auth.example.com/par"`.
- `end_session_endpoint` (string (uri), optional): Example: `"https://auth.example.com/end_session"`.
- `check_session_iframe` (string (uri), optional): Example: `"https://auth.example.com/check_session_iframe"`.
- `scopes_supported` (array of strings, optional): A JSON array of strings.
- `response_modes_supported` (array of strings, optional): A JSON array of strings.
- `grant_types_supported` (array of strings, optional): A JSON array of strings.
- `userinfo_signing_alg_values_supported` (array of strings, optional): A JSON array of strings.
- `request_object_signing_alg_values_supported` (array of strings, optional): A JSON array of strings.
- `token_endpoint_auth_methods_supported` (array of strings, optional): A JSON array of strings.
- `token_endpoint_auth_signing_alg_values_supported` (array of strings, optional): A JSON array of strings.
- `revocation_endpoint_auth_methods_supported` (array of strings, optional): A JSON array of strings.
- `revocation_endpoint_auth_signing_alg_values_supported` (array of strings, optional): A JSON array of strings.
- `introspection_endpoint_auth_methods_supported` (array of strings, optional): A JSON array of strings.
- `introspection_endpoint_auth_signing_alg_values_supported` (array of strings, optional): A JSON array of strings.
- `code_challenge_methods_supported` (array of strings, optional): A JSON array of strings.
- `dpop_signing_alg_values_supported` (array of strings, optional): A JSON array of strings.
- `authorization_details_types_supported` (array of strings, optional): A JSON array of strings.
- `claims_supported` (array of strings, optional): A JSON array of strings.
- `ui_locales_supported` (array of strings, optional): A JSON array of strings.
- `acr_values_supported` (array of strings, optional): A JSON array of strings.
- `claims_parameter_supported` (boolean, optional): Example: `true`.
- `request_parameter_supported` (boolean, optional): Example: `false`.
- `request_uri_parameter_supported` (boolean, optional): Example: `true`.
- `require_request_uri_registration` (boolean, optional): Example: `true`.
- `require_pushed_authorization_requests` (boolean, optional): Example: `false`.
- `authorization_response_iss_parameter_supported` (boolean, optional): Example: `true`.
- `tls_client_certificate_bound_access_tokens` (boolean, optional): Example: `false`.
- `backchannel_logout_supported` (boolean, optional): Example: `false`.
- `backchannel_logout_session_supported` (boolean, optional): Example: `false`.
- `frontchannel_logout_supported` (boolean, optional): Example: `false`.
- `frontchannel_logout_session_supported` (boolean, optional): Example: `false`.
- `service_documentation` (string (uri), optional)
- `op_policy_uri` (string (uri), optional)
- `op_tos_uri` (string (uri), optional)

## Example request

```bash
curl 'https://auth.example.com/.well-known/openid-configuration'
```

## Example response (200)

```json
{
  "issuer": "https://auth.example.com",
  "authorization_endpoint": "https://auth.example.com/authorize",
  "token_endpoint": "https://auth.example.com/token",
  "userinfo_endpoint": "https://auth.example.com/userinfo",
  "jwks_uri": "https://auth.example.com/.well-known/jwks.json",
  "registration_endpoint": "https://auth.example.com/register",
  "introspection_endpoint": "https://auth.example.com/introspect",
  "revocation_endpoint": "https://auth.example.com/revoke",
  "device_authorization_endpoint": "https://auth.example.com/device_authorization",
  "pushed_authorization_request_endpoint": "https://auth.example.com/par",
  "end_session_endpoint": "https://auth.example.com/end_session",
  "response_types_supported": [
    "code"
  ],
  "response_modes_supported": [
    "query"
  ],
  "subject_types_supported": [
    "public"
  ],
  "id_token_signing_alg_values_supported": [
    "ES256"
  ],
  "scopes_supported": [
    "openid",
    "profile",
    "email",
    "offline_access"
  ],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "none",
    "private_key_jwt"
  ],
  "grant_types_supported": [
    "authorization_code",
    "refresh_token",
    "client_credentials",
    "urn:ietf:params:oauth:grant-type:device_code"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ],
  "dpop_signing_alg_values_supported": [
    "ES256"
  ],
  "authorization_response_iss_parameter_supported": true,
  "require_pushed_authorization_requests": false
}
```