OIDC

Provides OIDC authentication, token, user-information, and discovery metadata APIs.

📄️ Get OIDC Discovery Metadata

Return the OpenID Connect discovery document.

📄️ Get OIDC JWKS

JWKS endpoint - returns RSA public key for token verification. Used by oidc-client-ts and other OIDC clients to verify ID tokens.

📄️ Start OIDC Authorization

Handle an authorization code request. Supports PKCE.

📄️ Authorize Callback

Handle upstream IdP callback and issue an authorization code.

📄️ Issue OIDC Token

Issue tokens via authorization code or refresh token exchange.

📄️ Get OIDC User Information

Return user information for the given access token.

📄️ Revoke OIDC Token

Revoke a token.

📄️ Introspect OIDC Token

Introspect a token to check its validity. Works regardless of OIDC configuration. Handles service tokens, local JWT (HS256), OIDC JWT (RS256), and OIDC refresh tokens.

📄️ Logout API

Log out through the API by revoking D.Hub session tokens without ending the upstream SSO session.

📄️ Logout Redirect

Log out through the browser by revoking D.Hub session tokens and ending the upstream SSO session.

📄️ Issue Delegated Token

Exchange a Service JWT for a token scoped to the resource's owner. An unattended workload has no user session to delegate from, so defines its identity as the resolved owner — but until now there was no *credential* for that identity. This is it. The issued token is an ordinary user token, which is the decisive property: the manager, SQLway and knowledge services accept it with no change on their side.