/.well-known

OpenID Connect discovery document (provider metadata). A public, unauthenticated document advertising fylr's OAuth2 / OpenID Connect issuer and endpoints so that OIDC clients can configure themselves.

Served at the server root (/.well-known/openid-configuration) — not under /api/v1. The endpoint URLs it returns are absolute, built from the instance's configured external URL (fylr.externalURL), and point at /api/oauth2/*.

The route is not method-restricted: any HTTP method returns the same metadata document with status 200.

GET /.well-known/openid-configuration — Fetch the OpenID Connect provider metadata.

Fetch the OpenID Connect provider metadata.

get

Responses

200

The discovery document.

application/json

issuerstring · uriRequired

The instance's external URL.

authorization_endpointstring · uriRequired

token_endpointstring · uriRequired

introspection_endpointstring · uriRequired

revocation_endpointstring · uriRequired

userinfo_endpointstring · uriRequired

response_types_supportedstring[]Optional

grant_types_supportedstring[]Optional

scopes_supportedstring[]Optional

claims_supportedstring[]Optional

The claim names userinfo may return — always sub, plus every claim enabled in the base config's openid.userinfo list (email_verified is included only when email is enabled).

code_challenge_methods_supportedstring[]Optional

Always ["S256"].

id_token_signing_alg_values_supportedstring[]Optional

Always ["RS256"].

subject_types_supportedstring[]Optional

Always ["public"].

200

The discovery document.

{
  "issuer": "https://demo.fylr.dev",
  "authorization_endpoint": "https://demo.fylr.dev/api/oauth2/auth",
  "token_endpoint": "https://demo.fylr.dev/api/oauth2/token",
  "introspection_endpoint": "https://demo.fylr.dev/api/oauth2/introspect",
  "revocation_endpoint": "https://demo.fylr.dev/api/oauth2/revoke",
  "userinfo_endpoint": "https://demo.fylr.dev/api/oauth2/userinfo",
  "response_types_supported": [
    "id_token",
    "code",
    "token",
    "id_token token",
    "code id_token",
    "code token",
    "code id_token token"
  ],
  "grant_types_supported": [
    "implicit",
    "refresh_token",
    "authorization_code",
    "password",
    "client_credentials"
  ],
  "scopes_supported": [
    "read",
    "write",
    "openid",
    "offline"
  ],
  "claims_supported": [
    "sub",
    "email",
    "email_verified"
  ],
  "code_challenge_methods_supported": [
    "S256"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "subject_types_supported": [
    "public"
  ]
}