{"revision":"9f11a31dd2951db0","language":"en","entry":{"id":"oidc-discovery","kind":"endpoint","group":"oidc","title":"Read the OpenID configuration","method":"GET","path":"/.well-known/openid-configuration","paths":[],"summary":"The discovery document of Sign in with Veil: issuer https://veil.rip, the endpoints, scopes, algorithms and methods.","response":"The provider's metadata (OpenID Connect Discovery 1.0).","parameters":[],"sample":"/.well-known/openid-configuration","access":"public","base":"directory","notes":["Cache-Control: public, max-age=3600. CORS allows any origin.","No API key is read here: an Authorization header on /oidc/ is the app's or the person's own credential."],"errors":["404 not_found","429 rate_limited","500 internal_error","503 busy"],"related":["sign-in-with-veil"],"sections":[{"kind":"code","language":"shell","code":"curl -fsS 'https://veil.rip/.well-known/openid-configuration'"}],"live":false,"responses":[{"status":200,"contentType":"application/json","description":"The provider's metadata (OpenID Connect Discovery 1.0).","fields":[{"name":"issuer","type":"string","description":"https://veil.rip. Compare it with the iss of every token and of the authorization response."},{"name":"authorization_endpoint","type":"string","description":"/oidc/authorize."},{"name":"token_endpoint","type":"string","description":"/oidc/token."},{"name":"userinfo_endpoint","type":"string","description":"/oidc/userinfo."},{"name":"jwks_uri","type":"string","description":"/oidc/jwks."},{"name":"registration_endpoint","type":"string","description":"/oidc/register."},{"name":"end_session_endpoint","type":"string","description":"/oidc/logout."},{"name":"revocation_endpoint","type":"string","description":"/oidc/revoke."},{"name":"introspection_endpoint","type":"string","description":"/oidc/introspect."},{"name":"scopes_supported","type":"array<string>","description":"openid profile veil veil:accounts veil:orgs veil:keys."},{"name":"id_token_signing_alg_values_supported","type":"array<string>","description":"EdDSA and ES256."},{"name":"code_challenge_methods_supported","type":"array<string>","description":"S256 only: PKCE is required for every app."},{"name":"authorization_response_iss_parameter_supported","type":"boolean","description":"true: the response carries iss (RFC 9207)."}]}],"responseObjects":[],"errorFormat":"json","errorDetails":[{"status":404,"code":"not_found","description":"The requested card, key, alias, code or resource was not found.","action":"Check the identifier. Temporary codes and previews may already have expired or been used.","scope":"endpoint"},{"status":429,"code":"rate_limited","description":"An anonymous, signed-request or API-key allowance was exceeded.","action":"Wait at least `Retry-After` seconds. Share a queue and retry budget across your workers.","scope":"common"},{"status":500,"code":"internal_error","description":"An unexpected server error occurred. Internal details are not returned.","action":"Retry reads with bounded backoff. Check write results before sending a new signed operation.","scope":"common"},{"status":503,"code":"busy","description":"The application has reached a temporary concurrency or database limit.","action":"Wait `Retry-After` seconds and retry with bounded backoff.","scope":"common"}],"responseHeaders":[{"name":"Cache-Control","value":"public, max-age=3600","description":"One hour."}],"documentationUrl":"https://veil.rip/docs/oidc-discovery","supportsBrowserFetch":true,"browserMode":"fetch"}}