---
title: "OIDC and OAuth"
description: "Discovery, authorization, token, logout, and OAuth extension endpoints."
locale: "en"
---

> Documentation Index
> Fetch the locale documentation index at: https://xid.dev/en/llms.txt
> Use this file to discover all available pages before exploring further.

# OIDC and OAuth

## Core endpoints

| Endpoint | Description |
| --- | --- |
| `/.well-known/openid-configuration` | OIDC discovery for the current issuer. |
| `/.well-known/oauth-protected-resource` | OAuth protected resource metadata for XID-hosted resource endpoints. |
| `/jwks` | Instance public signing keys with active and rotating kids. |
| `/authorize` | Authorization endpoint with PKCE, state, nonce, PAR, and Hosted Auth handoff. |
| `/par` | Pushed Authorization Requests with one-time request\_uri values. |
| `/token` | Authorization code, refresh token, client credentials, device code, and token exchange. |
| `/userinfo` | Bearer or DPoP access token user claims. |
| `/end_session` | RP-initiated logout with registered post logout redirects. |

## Protocol requirements

- PKCE uses S256. Plain PKCE is rejected.
- Redirect URI matching is exact. Wildcards are not accepted.
- Authorization codes are one-time use.
- Refresh tokens rotate on every use and replay revokes the token family.
- DPoP-bound clients must present a valid DPoP proof for token and resource calls. Authorization request `dpop_jkt` is bound to authorization code exchange.

## Support levels

| Level | OAuth and OIDC features |
| --- | --- |
| Implemented | Authorization code, PKCE S256, refresh rotation, PAR, DPoP proof and `dpop_jkt` binding, dynamic client registration, ID tokens, userinfo, hybrid response types, signed JAR request objects, signed JARM responses, RAR`resource_access` authorization details, token-exchange refresh and ID token issuance, mTLS client authentication, and front-channel logout. |
| Provider-ready | Device authorization polling, Session Management check\_session, CIBA backchannel approval, FAPI 2.0 / Browser-Based Apps profile gates, OpenID Federation, and Shared Signals expose guarded-minimal or provider-ready subsets. GNAP, UMA, HEART, OpenID4VP, and OpenID4VCI return negative or 501 stubs until full profiles ship. |
| Planned | Downstream SaaS OIDC uses the current generic OIDC baseline locally, but SaaS-specific production support still requires real SaaS L4. |
| Deprecated or not supported | Implicit flow, password grant, plain PKCE, and wildcard redirects. |

## Role boundaries

| XID role | Current public status |
| --- | --- |
| OIDC / OAuth identity provider for customer applications | Implemented in local and Worker routes with authorization code, PKCE S256, PAR, DPoP, JAR, JARM, RAR, discovery, JWKS, token, userinfo, introspection, and revocation coverage. |
| Upstream enterprise OIDC relying party | Provider-ready for enterprise connections. Production support requires a real IdP configuration and callback L4. |
| Social OAuth relying party | Provider-ready for GitHub, Google, Microsoft account, and Apple. See Social login for provider-specific boundaries. |
| Downstream SaaS OIDC identity provider | Generic OIDC baseline is available locally. SaaS-specific app templates and real SaaS L4 are still required before production support claims. |

## Client types

| Client | Recommended flow |
| --- | --- |
| Web application | Authorization code with server side token exchange. |
| SPA | Authorization code with PKCE S256. |
| Native app | Authorization code with PKCE S256 and claimed redirects. |
| Machine to machine | Client credentials with scoped access. |

## Guarded or minimal OAuth and OIDC extensions

| Level | Status |
| --- | --- |
| Assertion grants | JWT bearer and SAML bearer assertion grants are not enabled. Registration rejects assertion grant metadata until a trust root exists. |
| GNAP, UMA, HEART, OpenID4VP, OpenID4VCI | Minimal route subsets and discovery-friendly metadata are exposed. Unsupported operations return explicit errors until full profile handlers ship. |

Source: https://xid.dev/oidc-oauth/index.mdx