OIDC endpoints

All paths are relative to your issuer, for example https://acme.gatekeepauth.com.

Endpoints

Endpoint	Method	What it’s for
`/.well-known/openid-configuration`	GET	Discovery. Lists everything below.
`/authorize`	GET	Starts sign-in. Your app redirects the browser here.
`/token`	POST	Exchanges a code (or a refresh token) for tokens.
`/userinfo`	GET	Returns the user’s claims for a valid access token.
`/jwks.json`	GET	Public keys for verifying tokens.
`/logout`	GET	Ends the user’s Gatekeep session in this browser.

Discovery document

{
  "issuer": "https://acme.gatekeepauth.com",
  "authorization_endpoint": "https://acme.gatekeepauth.com/authorize",
  "token_endpoint": "https://acme.gatekeepauth.com/token",
  "userinfo_endpoint": "https://acme.gatekeepauth.com/userinfo",
  "end_session_endpoint": "https://acme.gatekeepauth.com/logout",
  "jwks_uri": "https://acme.gatekeepauth.com/jwks.json",
  "response_types_supported": ["code"],
  "grant_types_supported": ["authorization_code", "refresh_token"],
  "subject_types_supported": ["public"],
  "id_token_signing_alg_values_supported": ["EdDSA"],
  "code_challenge_methods_supported": ["S256"],
  "scopes_supported": ["openid", "email", "offline_access"],
  "claims_supported": ["sub", "iss", "aud", "exp", "iat", "email", "email_verified"],
  "token_endpoint_auth_methods_supported": ["none"]
}

Scopes

Scope	Gives you
`openid`	Required. An ID token with `sub`.
`email`	`email` and `email_verified` in the ID token and `/userinfo`.
`offline_access`	A refresh token, valid for 30 days and rotated on every use.

/authorize parameters

Parameter	Required	Notes
`response_type`	Yes	Always `code`.
`client_id`	Yes	Your app’s client ID.
`redirect_uri`	Yes	Must exactly match a registered URI.
`scope`	Yes	Must include `openid`.
`state`	Yes	A random value. Gatekeep echoes it back; check it matches.
`code_challenge`	Yes	Base64url SHA-256 of your `code_verifier`.
`code_challenge_method`	Yes	Always `S256`.
`nonce`	Recommended	Echoed in the ID token. Check it matches.
`prompt`	No	`none` for silent sign-in, `login` to always ask. See Single sign-on and logout.

/token

Send a form-encoded POST (application/x-www-form-urlencoded). There’s no client secret.

POST /token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&code=gkc_…
&redirect_uri=https://app.yourapp.com/auth/callback
&client_id=acme-notes
&code_verifier=…

Errors use the standard OAuth shape, for example {"error": "invalid_grant", "error_description": "code expired"}.

/userinfo

GET /userinfo
Authorization: Bearer <access_token>

{ "sub": "01JB7Q4M9W2X8YDN3T5K6RZ0HV", "email": "ada@acme.dev", "email_verified": true }

Use it when you need to know the account is still active right now, not just when the token was issued.