OIDC Registration Configuration

This site highlights attributes of OIDC registrations, configuration options that exist, and what their functionality is.

Overview

The OpenID Connect Dynamic Registration standard (based on OAuth 2.0 Dynamic Client Registration Protocol - RFC 7591) specifies how applications can dynamically register themselves with an authorization server without manual configuration. This includes defining the schema for the configuration of a registration.

Example Registration JSON

{
  "client_name": "My Example Application",
  "redirect_uris": ["https://example.com/callback"],
  "token_endpoint_auth_method": "client_secret_basic",
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "scope": "openid profile email"
}

There are a few security-related configuration options:

grant_types

The OAuth 2.0 grant types (flows) the client is allowed to use. Possible values include:

token_endpoint_auth_method

This details how the client authenticates when requesting tokens from the token endpoint. Possible values include:

response_types

This specifies what the authorization endpoint returns in the authorization response. Possible values include:

Modern Best Practices (2025+)

For Web Applications

{
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "private_key_jwt"
}

For Single Page Applications (SPAs)

{
  "grant_types": ["authorization_code", "refresh_token"],
  "response_types": ["code"],
  "token_endpoint_auth_method": "none"
}

Note: Must use PKCE (Proof Key for Code Exchange)

For Backend Services

{
  "grant_types": ["client_credentials"],
  "response_types": [],
  "token_endpoint_auth_method": "private_key_jwt"
}

References