OpenID Configuration API

Edit MD

On this page

The OpenID metadata describing the configuration as defined by Section 3. OpenID Provider Metadata.

Request#

Returns the well known OpenID Configuration JSON document

GET/{tenantId}/.well-known/openid-configuration

GET/.well-known/openid-configuration/{tenantId}

GET/.well-known/openid-configuration

OpenAPI Spec

URL segment#

tenantId

Type: UUID
Required
Available since 1.46.0

The tenant identifier.

Path Parameters#

tenantId

Type: UUID
Optional
Available since 1.8.0

The tenant identifier. If provided then a specific issuer will be returned, when this property is not provided the default tenant Id will be used.

Response#

The response for this request should always return a 200 with a JSON body.

Starting in version 1.70.0, the authorization_endpoint, device_authorization_endpoint, end_session_endpoint, and token_endpoint values end with the Id of the Tenant, such as https://piedpiper.fusionauth.io/oauth2/token/30663132-6464-6665-3032-326466613934. When the request doesn't specify a Tenant, they end with the Id of the default Tenant. These endpoints accept the Tenant Id as an optional URL segment. See the Authorize, Device, Logout, and Token endpoints.

Starting in version 1.70.0, the response also includes client_id_metadata_document_supported. The value is true when your license includes CIMD and the Tenant has at least one CIMD domain, and false otherwise.

Example JSON Response

{
  "authorization_endpoint": "https://piedpiper.fusionauth.io/oauth2/authorize/30663132-6464-6665-3032-326466613934",
  "backchannel_logout_supported": false,
  "claims_supported": [
    "applicationId",
    "at_hash",
    "aud",
    "authenticationType",
    "birthdate",
    "c_hash",
    "email",
    "email_verified",
    "exp",
    "family_name",
    "given_name",
    "iat",
    "iss",
    "jti",
    "middle_name",
    "name",
    "nbf",
    "nonce",
    "phone_number",
    "phone_number_verified",
    "picture",
    "preferred_username",
    "roles",
    "sub"
  ],
  "client_id_metadata_document_supported": false,
  "code_challenge_methods_supported": [
    "S256"
  ],
  "device_authorization_endpoint": "https://piedpiper.fusionauth.io/oauth2/device_authorize/30663132-6464-6665-3032-326466613934",
  "dpop_signing_alg_values_supported": [
    "Ed448",
    "Ed25519",
    "ES256",
    "ES384",
    "ES512",
    "PS256",
    "PS384",
    "PS512",
    "RS256",
    "RS384",
    "RS512"
  ],
  "end_session_endpoint": "https://piedpiper.fusionauth.io/oauth2/logout/30663132-6464-6665-3032-326466613934",
  "frontchannel_logout_supported": true,
  "grant_types_supported": [
    "authorization_code",
    "password",
    "implicit",
    "refresh_token",
    "urn:ietf:params:oauth:grant-type:device_code"
  ],
  "id_token_signing_alg_values_supported": [
    "ES256",
    "ES384",
    "ES512",
    "HS256",
    "HS384",
    "HS512",
    "RS256",
    "RS384",
    "RS512"
  ],
  "issuer": "piedpiper.fusionauth.io",
  "jwks_uri": "https://piedpiper.fusionauth.io/.well-known/jwks.json",
  "response_modes_supported": [
    "form_post",
    "fragment",
    "query"
  ],
  "response_types_supported": [
    "code",
    "id_token",
    "token id_token"
  ],
  "scopes_supported": [
    "openid",
    "offline_access"
  ],
  "subject_types_supported": [
    "public"
  ],
  "token_endpoint": "https://piedpiper.fusionauth.io/oauth2/token/30663132-6464-6665-3032-326466613934",
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "none"
  ],
  "userinfo_endpoint": "https://piedpiper.fusionauth.io/oauth2/userinfo",
  "userinfo_signing_alg_values_supported": [
    "ES256",
    "ES384",
    "ES512",
    "HS256",
    "HS384",
    "HS512",
    "RS256",
    "RS384",
    "RS512"
  ]
}

APIs

API documentation for the FusionAuth UserInfo OAuth2 endpoint.

fusionauth apirest apihttp api

APIs

Learn about the APIs for creating, retrieving, updating and deleting identity providers.

fusionauth apirest apihttp api

APIs

Learn about the APIs for creating, retrieving, updating and deleting OpenID Connect identity providers.

fusionauth apirest apihttp api

APIs

API documentation for the FusionAuth Authorize OAuth2 endpoint.

fusionauth apirest apihttp api