OpenID Specifications

https://openid.net/specs/
Admin
OpenID Specifications is a collection of technical specifications and standards for OpenID...
Tokens:8,051
Snippets:41
Trust Score:9.9
Update:1 week ago
Show doc for...
Tokens:
Raw
### form_post Response Mode Example: Request, HTML Form, and POST

Source: https://openid.net/specs/oauth-v2-form-post-response-mode-1_0.html

Non-normative example of the form_post response mode flow: the initial authorization request, the auto-submitting HTML form returned by the authorization server, and the resulting HTTP POST to the client. The id_token and state values are carried through all three steps.

```http
  GET /authorize?
   response_type=id_token
   &response_mode=form_post
   &client_id=some_client
   &scope=openid
   &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcallback
   &state=DcP7csa3hMlvybERqcieLHrRzKBra
   &nonce=2T1AgaeRTGTMAJyeDMN9IJbgiUG HTTP/1.1
  Host: server.example.com

```

```html
  HTTP/1.1 200 OK
  Content-Type: text/html;charset=UTF-8
  Cache-Control: no-cache, no-store
  Pragma: no-cache

  <html>
   <head><title>Submit This Form</title></head>
   <body onload="javascript:document.forms[0].submit()">
    <form method="post" action="https://client.example.org/callback">
      <input type="hidden" name="state"
       value="DcP7csa3hMlvybERqcieLHrRzKBra"/>
      <input type="hidden" name="id_token"
       value="eyJhbGciOiJSUzI1NiIsImtpZCI6IjEifQ.eyJzdWIiOiJqb2huIiw
         iYXVkIjoiZmZzMiIsImp0aSI6ImhwQUI3RDBNbEo0c2YzVFR2cllxUkIiLC
         Jpc3MiOiJodHRwczpcL1wvbG9jYWxob3N0OjkwMzEiLCJpYXQiOjEzNjM5M
         DMxMTMsImV4cCI6MTM2MzkwMzcxMywibm9uY2UiOiIyVDFBZ2FlUlRHVE1B
         SnllRE1OOUlKYmdpVUciLCJhY3IiOiJ1cm46b2FzaXM6bmFtZXM6dGM6U0F
         NTDoyLjA6YWM6Y2xhc3NlczpQYXNzd29yZCIsImF1dGhfdGltZSI6MTM2Mz
         kwMDg5NH0.c9emvFayy-YJnO0kxUNQqeAoYu7sjlyulRSNrru1ySZs2qwqq
         wwq-Qk7LFd3iGYeUWrfjZkmyXeKKs_OtZ2tI2QQqJpcfrpAuiNuEHII-_fk
         IufbGNT_rfHUcY3tGGKxcvZO9uvgKgX9Vs1v04UaCOUfxRjSVlumE6fWGcq
         XVEKhtPadj1elk3r4zkoNt9vjUQt9NGdm1OvaZ2ONprCErBbXf1eJb4NW_h
         nrQ5IKXuNsQ1g9ccT5DMtZSwgDFwsHMDWMPFGax5Lw6ogjwJ4AQDrhzNCFc
         0uVAwBBb772-86HpAkGWAKOK-wTC6ErRTcESRdNRe0iKb47XRXaoz5acA"/>
    </form>
   </body>
  </html>

```

```http
  POST /callback HTTP/1.1
  Host: client.example.org
  Content-Type: application/x-www-form-urlencoded

  id_token=eyJhbGciOiJSUzI1NiIsImtpZCI6IjEifQ.eyJzdWIiOiJqb2huIiwiYX
         VkIjoiZmZzMiIsImp0aSI6ImhwQUI3RDBNbEo0c2YzVFR2cllxUkIiLCJpc
         3MiOiJodHRwczpcL1wvbG9jYWxob3N0OjkwMzEiLCJpYXQiOjEzNjM5MDMx
         MTMsImV4cCI6MTM2MzkwMzcxMywibm9uY2UiOiIyVDFBZ2FlUlRHVE1BSnl
         lRE1OOUlKYmdpVUciLCJhY3IiOiJ1cm46b2FzaXM6bmFtZXM6dGM6U0FNTD
         oyLjA6YWM6Y2xhc3NlczpQYXNzd29yZCIsImF1dGhfdGltZSI6MTM2MzkwM
         Dg5NH0.c9emvFayy-YJnO0kxUNQqeAoYu7sjlyulRSNrru1ySZs2qwqqwwq
         -Qk7LFd3iGYeUWrfjZkmyXeKKs_OtZ2tI2QQqJpcfrpAuiNuEHII-_fkIuf
         bGNT_rfHUcY3tGGKxcvZO9uvgKgX9Vs1v04UaCOUfxRjSVlumE6fWGcqXVE
         KhtPadj1elk3r4zkoNt9vjUQt9NGdm1OvaZ2ONprCErBbXf1eJb4NW_hnrQ
         5IKXuNsQ1g9ccT5DMtZSwgDFwsHMDWMPFGax5Lw6ogjwJ4AQDrhzNCFc0uV
         AwBBb772-86HpAkGWAKOK-wTC6ErRTcESRdNRe0iKb47XRXaoz5acA&
  state=DcP7csa3hMlvybERqcieLHrRzKBra

```

--------------------------------

### GET /authorize

Source: https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html

The OAuth 2.0 Authorization Endpoint accepts a `response_type` parameter with multiple values. This endpoint returns an authorization response containing the requested tokens and/or code, depending on the response type.

```APIDOC
## GET /authorize

### Description
The OAuth 2.0 Authorization Endpoint is used to request authorization from the resource owner. The `response_type` parameter can be set to a combination of `code`, `token`, and `id_token` to request multiple response values.

### Method
GET

### Endpoint
/authorize

### Parameters
#### Query Parameters
- **response_type** (string) - Required - The response type value, which can be one of: `code token`, `code id_token`, `id_token token`, or `code id_token token`.
- **client_id** (string) - Required - The client identifier.
- **redirect_uri** (string) - Required - The URI to redirect to after authorization.
- **state** (string) - Optional - An opaque value used to maintain state between the request and callback. If provided, the Authorization Server MUST echo its value in the response.

### Request Example
```
GET /authorize?
    response_type=id_token%20token
    &client_id=s6BhdRkqt3
    &redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb
    &state=af0ifjsldkj HTTP/1.1
Host: server.example.com
```

### Response
#### Success Response (302 Found)
The response is a redirect to the `redirect_uri` with the response parameters appended to the fragment (default response mode). The response includes:
- **access_token** (string) - The access token, if requested.
- **token_type** (string) - The access token type, if requested.
- **id_token** (string) - The ID token, if requested.
- **code** (string) - The authorization code, if requested.
- **expires_in** (integer) - The lifetime of the access token in seconds, if an access token is issued.
- **state** (string) - The state value echoed from the request, if provided.

#### Response Example
```
HTTP/1.1 302 Found
Location: https://client.example.org/cb#
  access_token=SlAV32hkKG
  &token_type=bearer
  &id_token=eyJ0 ... NiJ9.eyJ1c ... I6IjIifX0.DeWt4Qu ... ZXso
  &expires_in=3600
  &state=af0ifjsldkj
```

### Error Handling
If an error occurs, the Authorization Server SHOULD return an error response using the supplied Response Mode, or the default Response Mode (fragment) if none is supplied. The error response should include the `state` parameter if it was provided in the request.
```

--------------------------------

### none Response Type

Source: https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html

Registers the 'none' response type for OAuth 2.0 Authorization Requests. When used, the Authorization Server SHOULD NOT return any access credentials or ID Token in a successful response. The default response mode is query encoding.

```APIDOC
## none Response Type

### Description
Registers the `none` response type for use in OAuth 2.0 Authorization Requests. When supplied as the `response_type` parameter, the Authorization Server SHOULD NOT return an Authorization Code, Access Token, Access Token Type, or ID Token in a successful response. The default Response Mode is query encoding. This response type SHOULD NOT be combined with other response types.

### Method
Authorization Request (OAuth 2.0)

### Endpoint
Authorization Endpoint

### Parameters
#### Query Parameters
- **response_type** (string) - Required - Must be set to `none`.
- **redirect_uri** (string) - Optional - The URI to redirect the User Agent to after granting or denying access.
- **state** (string) - Optional - If supplied, the Authorization Server MUST echo its value as a response parameter in both successful and error responses.

### Response
#### Success Response
- **state** (string) - Optional - Echoed if provided in the request.

#### Error Response
- **state** (string) - Optional - Echoed if provided in the request.

### Response Mode
Default is query encoding. Both success and error responses SHOULD use the supplied Response Mode, or the default if none is supplied.
```

--------------------------------

### id_token Response Type

Source: https://openid.net/specs/oauth-v2-multiple-response-types-1_0.html

Registers the 'id_token' response type for OAuth 2.0 Authorization Requests. When used, a successful response must include an 'id_token' parameter, and the default response mode is fragment encoding.

```APIDOC
## id_token Response Type

### Description
Registers the `id_token` response type for use in OAuth 2.0 Authorization Requests. When supplied as the `response_type` parameter, a successful response MUST include the `id_token` parameter. The Authorization Server SHOULD NOT return an Authorization Code, Access Token, or Access Token Type in a successful response. The default Response Mode is fragment encoding, and query encoding MUST NOT be used.

### Method
Authorization Request (OAuth 2.0)

### Endpoint
Authorization Endpoint

### Parameters
#### Query Parameters
- **response_type** (string) - Required - Must be set to `id_token`.
- **redirect_uri** (string) - Optional - The URI to redirect the User Agent to after granting or denying access.
- **state** (string) - Optional - If supplied, the Authorization Server MUST echo its value as a response parameter in both successful and error responses.

### Response
#### Success Response
- **id_token** (string) - Required - The identity assertion.
- **state** (string) - Optional - Echoed if provided in the request.

#### Error Response
- **state** (string) - Optional - Echoed if provided in the request.

### Response Mode
Default is fragment encoding. Query encoding MUST NOT be used. Both success and error responses SHOULD use the supplied Response Mode, or the default if none is supplied.
```
Tokens:
Raw