OpenID Connect
Auth Code + PKCE Flow
- Generate code_verifier + code_challenge (S256)
- Redirect to /authorize with client_id, redirect_uri, scope=openid, code_challenge
- Exchange code for tokens at /token endpoint
- Validate id_token JWT with JWKS
Token Exchange
const res = await fetch(tokenUrl, {
method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
body: new URLSearchParams({ grant_type: 'authorization_code', code, redirect_uri, client_id, code_verifier }),
});
const { access_token, id_token, refresh_token } = await res.json();
Validate ID Token
import { jwtVerify, createRemoteJWKSet } from 'jose';
const JWKS = createRemoteJWKSet(new URL(issuer + '/.well-known/jwks.json'));
const { payload } = await jwtVerify(id_token, JWKS, { issuer, audience: clientId });
Discovery: GET /.well-known/openid-configuration
ComeOnOliver