Get the discovery document

The org's OpenID Connect discovery document, from which a client library finds every other endpoint.

The org’s discovery metadata (OIDC Discovery). Point your library at it and it finds the rest. The same document is served at /.well-known/oauth-authorization-server (RFC 8414) for OAuth-only clients such as MCP clients.

Authorization

None. This route is public.

Response

200, cacheable for an hour (Cache-Control: public, max-age=3600).

{
  "issuer": "https://acme.loginwith.dev/",
  "jwks_uri": "https://acme.loginwith.dev/.well-known/jwks.json",
  "userinfo_endpoint": "https://acme.loginwith.dev/users/me",
  "token_endpoint": "https://acme.loginwith.dev/oauth/token",
  "authorization_endpoint": "https://acme.loginwith.dev/oauth/authorize",
  "revocation_endpoint": "https://acme.loginwith.dev/oauth/revoke",
  "response_types_supported": ["code"],
  "grant_types_supported": [
    "authorization_code",
    "refresh_token",
    "client_credentials",
    "urn:ietf:params:oauth:grant-type:token-exchange",
    "urn:loginwith:params:oauth:grant-type:switch-tenant"
  ],
  "token_endpoint_auth_methods_supported": ["none", "client_secret_basic", "client_secret_post"],
  "revocation_endpoint_auth_methods_supported": ["none"],
  "code_challenge_methods_supported": ["S256"],
  "subject_types_supported": ["public"],
  "id_token_signing_alg_values_supported": ["RS256"],
  "acr_values_supported": ["aal1", "aal2", "aal3"],
  "claims_supported": [
    "iss", "aud", "sub", "exp", "iat", "jti", "typ", "tnt", "sid",
    "amr", "acr", "act", "azp",
    "email", "given_name", "family_name", "name", "picture",
    "provider", "labels"
  ]
}

Errors

Example

curl https://acme.loginwith.dev/.well-known/openid-configuration