dunkirk.sh
ERROR
SPEC.md
ERROR
SPEC.md
Failed to calculate interdiff for this file.
ERROR
bun.lock
ERROR
bun.lock
Failed to calculate interdiff for this file.
ERROR
package.json
ERROR
package.json
Failed to calculate interdiff for this file.
ERROR
scripts/reset-passkey.ts
ERROR
scripts/reset-passkey.ts
Failed to calculate interdiff for this file.
ERROR
src/client/index.ts
ERROR
src/client/index.ts
Failed to calculate interdiff for this file.
ERROR
src/index.ts
ERROR
src/index.ts
Failed to calculate interdiff for this file.
ERROR
src/migrations/008_add_oidc_keys.sql
ERROR
src/migrations/008_add_oidc_keys.sql
Failed to calculate interdiff for this file.
ERROR
src/oidc.ts
ERROR
src/oidc.ts
Failed to calculate interdiff for this file.
ERROR
src/routes/api.ts
ERROR
src/routes/api.ts
Failed to calculate interdiff for this file.
ERROR
src/routes/auth.ts
ERROR
src/routes/auth.ts
Failed to calculate interdiff for this file.
ERROR
src/routes/clients.ts
ERROR
src/routes/clients.ts
Failed to calculate interdiff for this file.
ERROR
src/routes/indieauth.ts
ERROR
src/routes/indieauth.ts
Failed to calculate interdiff for this file.
ERROR
src/routes/passkeys.ts
ERROR
src/routes/passkeys.ts
Failed to calculate interdiff for this file.
NEW
README.md
NEW
README.md
···
130
130
131
131
Now you can sign in to IndieAuth-compatible sites using `https://your-domain.com/` as your identity.
132
132
133
+
### Using as an OpenID Connect (OIDC) Provider
134
+
135
+
Indiko also supports OpenID Connect (OIDC) for modern authentication flows:
136
+
137
+
**Discovery endpoint:**
138
+
```
139
+
https://your-indiko-domain.com/.well-known/openid-configuration
140
+
```
141
+
142
+
**Key features:**
143
+
- Authorization Code Flow with PKCE
144
+
- ID Token with RS256 signing
145
+
- JWKS endpoint for token verification
146
+
- Support for `openid`, `profile`, and `email` scopes
147
+
- Userinfo endpoint for retrieving user claims
148
+
149
+
Test your OIDC setup using the [OIDC Debugger](https://oidcdebugger.com/).
150
+
133
151
## API Reference
134
152
135
-
### OAuth 2.0 Endpoints
153
+
### OAuth 2.0 / OpenID Connect Endpoints
136
154
137
-
- `GET /auth/authorize` - Authorization endpoint
138
-
- `POST /auth/token` - Token exchange endpoint
155
+
- `GET /auth/authorize` - Authorization endpoint (OAuth 2.0 / OIDC)
156
+
- `POST /auth/token` - Token exchange endpoint (returns access token and ID token for OIDC)
157
+
- `GET /userinfo` - OIDC userinfo endpoint (returns user claims)
158
+
- `GET /.well-known/openid-configuration` - OIDC discovery document
159
+
- `GET /jwks` - JSON Web Key Set for ID token verification
139
160
- `POST /auth/logout` - Session logout
140
161
141
162
### User Profile
NEW
src/html/docs.html
NEW
src/html/docs.html
···
577
577
<h3>table of contents</h3>
578
578
<ul>
579
579
<li><a href="#overview">overview</a></li>
580
+
<li><a href="#oidc">openid connect (oidc)</a></li>
580
581
<li><a href="#getting-started">getting started</a></li>
581
582
<li><a href="#button">sign in button</a></li>
582
583
<li><a href="#endpoints">endpoints</a></li>
···
612
613
<ul>
613
614
<li>Passwordless authentication via WebAuthn passkeys</li>
614
615
<li>Full IndieAuth and OAuth 2.0 support with PKCE</li>
616
+
<li>OpenID Connect (OIDC) support with ID tokens</li>
615
617
<li>Access tokens and refresh tokens for API access</li>
616
618
<li>Token introspection and revocation endpoints</li>
617
619
<li>UserInfo endpoint for profile data</li>
···
621
623
<li>User profile endpoints with h-card microformats</li>
622
624
<li>Invite-based user registration</li>
623
625
</ul>
626
+
</section>
627
+
628
+
<section id="oidc" class="section">
629
+
<h2>openid connect (oidc)</h2>
630
+
<p>
631
+
Indiko supports OpenID Connect (OIDC) for modern authentication flows, enabling "Sign in with Indiko" for any OIDC-compatible application.
632
+
</p>
633
+
634
+
<h3>oidc endpoints</h3>
635
+
<table>
636
+
<thead>
637
+
<tr>
638
+
<th>Endpoint</th>
639
+
<th>Description</th>
640
+
</tr>
641
+
</thead>
642
+
<tbody>
643
+
<tr>
644
+
<td><code>/.well-known/openid-configuration</code></td>
645
+
<td>OIDC discovery document</td>
646
+
</tr>
647
+
<tr>
648
+
<td><code>/jwks</code></td>
649
+
<td>JSON Web Key Set for ID token verification</td>
650
+
</tr>
651
+
<tr>
652
+
<td><code>/auth/authorize</code></td>
653
+
<td>Authorization endpoint (same as OAuth 2.0)</td>
654
+
</tr>
655
+
<tr>
656
+
<td><code>/auth/token</code></td>
657
+
<td>Token endpoint (returns ID token when <code>openid</code> scope requested)</td>
658
+
</tr>
659
+
<tr>
660
+
<td><code>/userinfo</code></td>
661
+
<td>OIDC userinfo endpoint</td>
662
+
</tr>
663
+
</tbody>
664
+
</table>
665
+
666
+
<h3>key features</h3>
667
+
<ul>
668
+
<li>Authorization Code Flow with PKCE</li>
669
+
<li>ID Token with RS256 signing</li>
670
+
<li>Support for <code>openid</code>, <code>profile</code>, and <code>email</code> scopes</li>
671
+
<li>Automatic key generation and management</li>
672
+
<li>Standards-compliant discovery document</li>
673
+
</ul>
674
+
675
+
<h3>id token claims</h3>
676
+
<p>
677
+
When the <code>openid</code> scope is requested, the token endpoint returns an ID token (JWT) containing:
678
+
</p>
679
+
<ul>
680
+
<li><code>iss</code> - Issuer (Indiko server URL)</li>
681
+
<li><code>sub</code> - Subject (user identifier)</li>
682
+
<li><code>aud</code> - Audience (client ID)</li>
683
+
<li><code>exp</code> - Expiration time</li>
684
+
<li><code>iat</code> - Issued at time</li>
685
+
<li><code>auth_time</code> - Authentication time</li>
686
+
<li><code>nonce</code> - Nonce (if provided in authorization request)</li>
687
+
<li><code>name</code>, <code>email</code>, <code>picture</code>, <code>website</code> - User claims (based on granted scopes)</li>
688
+
</ul>
689
+
690
+
<div class="info-box">
691
+
<strong>Testing:</strong>
692
+
You can test your OIDC setup using the <a href="https://oidcdebugger.com/" target="_blank" rel="noopener noreferrer">OIDC Debugger</a>. Set the discovery endpoint and use PKCE with SHA-256.
693
+
</div>
624
694
</section>
625
695
626
696
<section id="getting-started" class="section">
···
1032
1102
</thead>
1033
1103
<tbody>
1034
1104
<tr>
1105
+
<td><code>openid</code></td>
1106
+
<td>OpenID Connect authentication</td>
1107
+
<td>Triggers ID token issuance (OIDC only)</td>
1108
+
</tr>
1109
+
<tr>
1035
1110
<td><code>profile</code></td>
1036
1111
<td>Basic profile information</td>
1037
1112
<td>name, photo, URL</td>
···
1046
1121
1047
1122
<div class="info-box">
1048
1123
<strong>Note:</strong>
1049
-
Users can selectively approve scopes during authorization. Your app may receive fewer scopes than requested.
1124
+
Users can selectively approve scopes during authorization. Your app may receive fewer scopes than requested. The <code>openid</code> scope is only relevant for OIDC flows and enables ID token issuance.
1050
1125
</div>
1051
1126
</section>
1052
1127