Read the OpenID configuration
The discovery document of Sign in with Veil: issuer https://veil.rip, the endpoints, scopes, algorithms and methods.
/.well-known/openid-configuration- Access
- Public; API key optional
- Client
- Browser fetch supported
Request examples#
curl -fsS 'https://veil.rip/.well-known/openid-configuration'Response#
The provider's metadata (OpenID Connect Discovery 1.0).
| Field | Type | Meaning |
|---|---|---|
issuer | string | https://veil.rip. Compare it with the iss of every token and of the authorization response. |
authorization_endpoint | string | /oidc/authorize. |
token_endpoint | string | /oidc/token. |
userinfo_endpoint | string | /oidc/userinfo. |
jwks_uri | string | /oidc/jwks. |
registration_endpoint | string | /oidc/register. |
end_session_endpoint | string | /oidc/logout. |
revocation_endpoint | string | /oidc/revoke. |
introspection_endpoint | string | /oidc/introspect. |
scopes_supported | array<string> | openid profile veil veil:accounts veil:orgs veil:keys. |
id_token_signing_alg_values_supported | array<string> | EdDSA and ES256. |
code_challenge_methods_supported | array<string> | S256 only: PKCE is required for every app. |
authorization_response_iss_parameter_supported | boolean | true: the response carries iss (RFC 9207). |
Response headers#
| Header | Value | Meaning |
|---|---|---|
Cache-Control | public, max-age=3600 | One hour. |
Usage notes#
- Cache-Control: public, max-age=3600. CORS allows any origin.
- No API key is read here: an Authorization header on /oidc/ is the app's or the person's own credential.
Errors#
API errors return an error object. Use error.code for program logic; error.message is English text for people and can change. Response and error guide
| HTTP | Code | Meaning and next step |
|---|---|---|
| 404 | not_found | The requested card, key, alias, code or resource was not found. Check the identifier. Temporary codes and previews may already have expired or been used. |
Shared request errors
| HTTP | Code | Meaning and next step |
|---|---|---|
| 429 | rate_limited | An anonymous, signed-request or API-key allowance was exceeded. Wait at least |
| 500 | internal_error | An unexpected server error occurred. Internal details are not returned. Retry reads with bounded backoff. Check write results before sending a new signed operation. |
| 503 | busy | The application has reached a temporary concurrency or database limit. Wait |