Easy for Developers

This service exposes a standard OpenID Connect/ OAuth2 interface. No prior registration is required: the client_id must simply match the hostname of your redirect_uri.

Endpoints

• GET /api/openid/authorize — starts the sign-in flow.
• POST /api/openid/token — exchanges an authorization code for an access token.
• GET /api/openid/userinfo — returns the signed-in user's info for a valid access token.

Flow

Only the authorization code flow (with PKCE) and the implicit id_token flow are supported. Supported response_type values are code, id_token, and code id_token. PKCE (code_challenge / code_verifier, method S256) is required for the code flow.

Scopes

openid profile email are supported and returned in the ID token / userinfo response.

Tokens

Access tokens are opaque, single-use-scoped, and short-lived (expire after 60 seconds), meant to be exchanged immediately for the user info via /api/openid/userinfo.