Integrate an application with OpenID Connect

AuthGuard is an OpenID Connect provider. Your application uses the authorization code flow and receives a signed ID token.

Addresses

The discovery document lists the authorization, token and userinfo endpoints.

The flow

1. Redirect to the authorization endpoint with response_type=code, the client_id, an exactly registered redirect_uri, scope=openid email profile, state, nonce and PKCE (code_challenge_method=S256).
2. The person confirms with a passkey (which signs that request and only that), their phone, or single sign-on.
3. Exchange the code at the token endpoint (the code lasts 120 seconds and works once).
4. Validate the ID token: signature (RS256 or ES256) against the JWKS, iss, aud, exp, nonce.

acr names the method: urn:authguard:acr:passkey:v1 or urn:authguard:acr:device-approval:v1. email_verified is true only for confirmed addresses or ones from a managed directory.

Refresh tokens, revocation and logout

• With refresh tokens on, each refresh returns a new token that replaces the previous one; reusing an old token revokes the whole family. Refresh lasts while the session exists, at most 24 hours, and lapses after 15 minutes unused.
• POST /oauth2/revoke revokes a token (RFC 7009).
• Application-initiated logout: /oauth2/logout?id_token_hint=…&post_logout_redirect_uri=…&state=…. Without id_token_hint, nothing is ended. There is no back-channel or front-channel logout.

prompt=none

Works only with a usable single sign-on session; otherwise login_required comes back.

Policy

Each sign-in is evaluated for the federation.authorize action with the resource equal to the client_id; without a rule the answer is access_denied.