Server Metadata

Server Metadata (RFC 8414 and OpenID Connect Discovery 1.0) is a standardized JSON document that lists every OAuth 2.1 and OpenID Connect endpoint, every supported algorithm, and every feature flag for a ThunderID instance. Clients fetch it once at startup (or on demand) and use it instead of hard-coding endpoint URLs.

ThunderID publishes two documents: one for OAuth and one for OIDC. The OIDC document is a strict superset of the OAuth one.

How It Works

Endpoint	Spec
GET /.well-known/oauth-authorization-server	RFC 8414
GET /.well-known/openid-configuration	OIDC Discovery 1.0

Both endpoints are public: no authentication required.

curl https://thunderid.example.com/.well-known/openid-configuration

{
  "issuer": "https://thunderid.example.com",
  "authorization_endpoint": "https://thunderid.example.com/oauth2/authorize",
  "token_endpoint": "https://thunderid.example.com/oauth2/token",
  "userinfo_endpoint": "https://thunderid.example.com/oauth2/userinfo",
  "introspection_endpoint": "https://thunderid.example.com/oauth2/introspect",
  "pushed_authorization_request_endpoint": "https://thunderid.example.com/oauth2/par",
  "registration_endpoint": "https://thunderid.example.com/oauth2/dcr/register",
  "jwks_uri": "https://thunderid.example.com/oauth2/jwks",

  "grant_types_supported": [
    "authorization_code",
    "client_credentials",
    "refresh_token",
    "urn:ietf:params:oauth:grant-type:token-exchange"
  ],
  "response_types_supported": ["code"],
  "code_challenge_methods_supported": ["S256"],
  "token_endpoint_auth_methods_supported": [
    "client_secret_basic",
    "client_secret_post",
    "private_key_jwt",
    "none"
  ],
  "dpop_signing_alg_values_supported": [
    "RS256", "RS512", "PS256", "ES256", "ES384", "ES512", "EdDSA"
  ],

  "subject_types_supported": ["public"],
  "id_token_signing_alg_values_supported": [
    "RS256", "RS512", "PS256", "ES256", "ES384", "ES512", "EdDSA"
  ],
  "id_token_encryption_alg_values_supported": ["RSA-OAEP", "RSA-OAEP-256"],
  "id_token_encryption_enc_values_supported": ["A128CBC-HS256", "A256GCM"],
  "userinfo_signing_alg_values_supported": [
    "RS256", "RS512", "PS256", "ES256", "ES384", "ES512", "EdDSA"
  ],
  "userinfo_encryption_alg_values_supported": ["RSA-OAEP", "RSA-OAEP-256"],
  "userinfo_encryption_enc_values_supported": ["A128CBC-HS256", "A256GCM"],

  "scopes_supported": ["openid", "profile", "email", "phone", "address"],
  "claims_supported": [
    "sub", "iss", "aud", "exp", "iat", "auth_time",
    "name", "given_name", "family_name", "preferred_username",
    "email", "email_verified",
    "phone_number", "phone_number_verified",
    "address"
  ],
  "claims_parameter_supported": true,
  "require_pushed_authorization_requests": false,
  "authorization_response_iss_parameter_supported": true,
  "acr_values_supported": ["urn:mace:incommon:iap:silver"]
}

The OAuth-only document at /.well-known/oauth-authorization-server omits the OIDC-specific fields (subject types, ID token algorithms, claims supported).

How ThunderID Implements It

Aspect	Behavior
Caching	The document is generated per-instance from runtime configuration. Cache freely on the client.
issuer	The deployment's configured issuer URL. Must match the iss claim in issued tokens.
Endpoint URLs	Absolute URLs rooted at the configured issuer
Subject types	public only. Pairwise subject identifiers are not supported
require_pushed_authorization_requests	Reflects the global oauth.par.require_par setting
authorization_response_iss_parameter_supported	Always true (see Issuer Identification)

Try It in ThunderID

No configuration is needed. The discovery endpoints are always served and reflect the current deployment's settings.

Use It from a Client

Most OAuth and OIDC SDKs accept a discovery URL and configure themselves from it:

// Generic OIDC client (pseudocode)
const config = await fetch(
  'https://thunderid.example.com/.well-known/openid-configuration'
).then(r => r.json());

const client = new OIDCClient({
  authorization_endpoint: config.authorization_endpoint,
  token_endpoint: config.token_endpoint,
  jwks_uri: config.jwks_uri,
  // ...
});

Related Guides

• JWKS, the public-key endpoint pointed to by jwks_uri
• Issuer Identification, uses the issuer value advertised here
• Pushed Authorization Requests, pushed_authorization_request_endpoint
• Dynamic Client Registration, registration_endpoint