Repository navigation
feat(oidc): application (client) management API #407
Description
Why
Admins need to register the apps that sign in through Seamless Auth.
What
- Create, update, rotate secret, delete clients
- Redirect URIs (exact match), grant types, token lifetimes, public versus confidential
- Audit for every change
Done when
Clients can be fully managed over the admin API.
Activity
Bccorb commentedon Oct 30, 2026
Architecture for this is settled in ADR 0001 (#520). The OpenID Provider runs in a separate public login edge (new repo, seamless-auth-oidc-provider) that signs users in through the first-party routes. The auth API stays private and cookie-free. See D5, D6, D10 and D12.
private_key_jwtis the default for confidential clients. Shared secrets needallow_client_secretsplus a per-client opt-in, and are stored hashed. Admin routes enforce the locked configuration and the device and third-party limits.