30+ standards, implemented to the letter

ID tokens, standard claims and authentication flows over OAuth 2.0.

Dynamic provider configuration via the well-known endpoint; signed metadata optional.

Dynamic client registration with OpenID providers.

Manage session state with check_session_iframe support.

Logout initiated by the relying party via the end-session endpoint.

Logout via front-channel communication.

Server-to-server logout using logout tokens.

Privacy by unique per-client subject identifiers.

Encoding practices for multiple response types.

Transmit responses via HTTP form posts.

Authorization code, implicit, client-credentials and password flows.

Bearer tokens with compliant challenges and correct error status codes.

Every 401 response carries an auth challenge matching the client's scheme.

Securely cancel access and refresh tokens.

Resource servers verify token state and metadata.

Auth on input-constrained devices, with brute-force protection.

Register and manage clients dynamically and securely.

Guarantees the authenticity of the authorization server to clients.

PKCE with S256 hardens authorization-code flows for public clients.

mTLS client auth with PKI and certificate-bound access tokens.

Clients push authorization requests directly to the server.

Authorization requests signed and optionally encrypted as JWTs.

Authorization responses secured as JWTs.

DPoP sender-constrains each token to a key the client must prove.

Fine-grained authorization beyond the coarse scope parameter.

Exchange token types and scope access to named resources.

Decoupled backchannel authentication - poll, ping and push modes.

Structure and use of JWTs for representing claims securely.

JWT profile for OAuth 2.0 access tokens.

Digital signatures and MACs for JSON data structures.

Encryption methods for JSON data structures.

JSON representation of cryptographic keys.

Cryptographic algorithms for JWS, JWE and JWK.

private_key_jwt / client_secret_jwt and JWT authorization grants.

Standard amr values for how the user was authenticated.

Signed, optionally encrypted JWT introspection responses.

HTTP Basic authentication with client credentials.

Client credentials sent in the POST body.

HMAC-signed JWT client assertion.

RSA/EC-signed JWT client assertion.

PKI mutual-TLS client authentication.

Self-signed certificate mutual-TLS authentication.

Public clients without authentication.