Repository navigation
feat(oidc): discovery, authorization code with PKCE, and userinfo #405
Description
Why
The core of the provider.
What
/.well-known/openid-configuration- Authorization endpoint, token endpoint, userinfo
- PKCE required; ID tokens signed with the existing JWKS
- Standard claims plus roles and organization
Done when
A generic OIDC client (for example Grafana or Auth.js) signs users in through Seamless Auth.
Activity
Bccorb commentedon Oct 30, 2026
Architecture for this is settled in ADR 0001 (#520). The OpenID Provider runs in a separate public login edge (new repo, seamless-auth-oidc-provider) that signs users in through the first-party routes. The auth API stays private and cookie-free. See D1, D3, D4, D5, D11 and D13. Most of this moves to the edge. On the API: the
/oidc/*storage and signing routes. ID tokens are signed with separate provider keys held by the API (D4), not the existing JWKS. The issuer is the edge URL.Bccorb commentedon Nov 1, 2026
Shipped in v0.21.0. Discovery, the authorization code flow with PKCE and userinfo are served by the OpenID Provider edge (seamless-auth-oidc-provider#10 and #13, released as 0.1.0) backed by the
/oidc/*routes in the API (#521). The OpenID Foundation Basic and Config OP plans pass in CI. Guide: https://docs.seamlessauth.com/build/openid-provider. Closing.