OpenID Connect

Add OIDC sign-in to your app.

Let users sign in with their Sudomimus account through an OIDC library. Sudomimus provides the login page and asks users which personal details they agree to share.

Create an application Read the integration guide

Connection parametersOIDC 1.0

issuer: "https://oidc.sudomimus.com"
client_id: "app_your_application"
response_type: "code"
scope: "openid email profile"

token_endpoint_auth_method: none
PKCE: S256 (Required)

issuer: "https://oidc.sudomimus.com"
client_id: "app_your_application"
response_type: "code"
scope: "openid email profile"

token_endpoint_auth_method: private_key_jwt
PKCE: S256 (Recommended)

Connection settings shown for reference. The guide includes examples for each library.

Provider discovery/.well-known/openid-configuration

Sign-in flowCode, Implicit & Hybrid

User identifiersPairwise subjects

Certified OpenID Provider profiles

Verify Sudomimus and the listed profiles in the OpenID Foundation's public registry.

View official profile records →

Basic OPForm Post
The profile for sign-in using the Authorization Code Flow.
Config OP
The profile for discovering the provider’s endpoints and settings.
Implicit OPForm Post
Front-channel ID Token delivery, with an optional access token.
Hybrid OPForm Post
Authorization codes combined with front-channel tokens.
Dynamic OP
Controlled client registration with an Initial Access Token.
3rd Party-Init OP
Start sign-in at the relying party from the provider.

Integration

Use an OIDC library for your browser or server.

Use oidc-client-ts in a browser app or openid-client on your server. Set the issuer, client ID, and callback URL; the guide covers client authentication and PKCE.

Read the integration guide →Choose OIDC or Connect for application sign-in →

User information

Request the user details your app needs.

Choose whether your app requests an email address, a name, or other profile details. Users grant sharing consent separately for each application.

User IDs are scoped to a sector

Apps in the same sector receive the same user ID. Apps in different sectors receive different IDs. The internal Sudomimus account ID stays private.

Sharing follows the user’s consent

The returned details depend on the requested scopes, your app’s current settings, and the user’s consent. If you require a detail, the user must agree to share it to complete sign-in.

One Sudomimus account

Sector A

Studio app

sub: a7f…29c

Shared: email

Sector B

Community app

sub: b3e…81d

Shared: name

Illustrative subjects and sharing choices

Get started

Configure your OIDC connection.

01
Create an application
Create your app in the developer portal and copy its client ID.
02
Add an OIDC return rule
Save your exact callback URLs, allowed scopes, and client authentication method.
03
Configure your library
Enter your connection settings, redirect a user to sign in, and handle the callback.