Quick Start

Get started with oidc.pub in minutes. Register a service, update your issuer URL, upload your OIDC configuration, and your discovery endpoint is live.

No-signup trial

For testing and relying-party setup with an existing issuer, create and sync an anonymous service without logging in:

npx oidc.pub service sync -a --source-url https://issuer.internal --once

For local OIDC claim debugging, use an anonymous service with the built-in dev issuer:

npx oidc.pub dev issuer --anonymous

Anonymous services get random -anon subdomains, print a one-time management secret, and expire automatically within 24 hours. The dev issuer mode creates the service first so its minted tokens use the anonymous public issuer URL.

Step 1: Create a service

Sign in and register a new OIDC service. Free and Team services receive a random URL name inside your tenant suffix. Business and Enterprise customers can choose the URL name prefix.

npx oidc.pub login
npx oidc.pub service create \
  --title "My Service" \
  --service-name myservice

docker run --rm -it \
  -v ~/.config/oidcpub:/home/oidcpub/.config/oidcpub \
  registry.gitlab.com/oidc.pub/cli:latest login

docker run --rm -it \
  -v ~/.config/oidcpub:/home/oidcpub/.config/oidcpub \
  registry.gitlab.com/oidc.pub/cli:latest \
  service create \
  --title "My Service" \
  --service-name myservice

curl -X POST https://oidc.pub/api/services \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "title": "My Service",
    "serviceName": "myservice"
  }'

Step 2: Update your issuer URL

Configure your service to use the returned issuer URL, for example https://myservice-9sfs.oidc.pub, as its issuer. Tokens minted after this change will carry the correct issuer claim that matches the public discovery endpoint.

Step 3: Upload your OIDC configuration

Push your openid-configuration and JWKS. Use the CLI sync command to fetch configuration directly from your issuer, or upload it manually via the API. The API rewrites the issuer and jwks_uri fields to point to your oidc.pub subdomain automatically.

npx oidc.pub service sync \
  --service myservice-9sfs \
  --source-url https://your-issuer.internal \
  --once

docker run --rm -it \
  -v ~/.config/oidcpub:/home/oidcpub/.config/oidcpub \
  registry.gitlab.com/oidc.pub/cli:latest-sync \
  --service myservice-9sfs \
  --source-url https://your-issuer.internal \
  --once

SERVICE_SUBDOMAIN=myservice-9sfs

curl -X PUT https://oidc.pub/api/services/$SERVICE_SUBDOMAIN/config \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "openidConfiguration": {
      "issuer": "https://myservice-9sfs.oidc.pub",
      "jwks_uri": "https://myservice-9sfs.oidc.pub/.well-known/jwks.json",
      "response_types_supported": ["id_token"],
      "subject_types_supported": ["public"],
      "id_token_signing_alg_values_supported": ["RS256"]
    },
    "jwks": {
      "keys": [
        {
          "kty": "RSA",
          "kid": "key-1",
          "use": "sig",
          "alg": "RS256",
          "n": "...",
          "e": "AQAB"
        }
      ]
    }
  }'

Use the service subdomain as the API route reference. Existing UUID service IDs are still accepted for compatibility.

Step 4: Verify

Your OIDC discovery endpoint is live within 60 seconds.

curl https://myservice-9sfs.oidc.pub/.well-known/openid-configuration | jq .