---
title: "Get the OpenID Connect discovery document"
method: GET
path: "/.well-known/openid-configuration"
tags: ["OAuth discovery"]
---

# Get the OpenID Connect discovery document

`GET /.well-known/openid-configuration`

## Request

- Base URL: `https://api.elaichi.ai`
- URL: `https://api.elaichi.ai/.well-known/openid-configuration`
- Auth: none required

Turns this authorization server into an OpenID provider as far as a relying party is concerned — the control an OpenAI ChatGPT Business or Enterprise admin needs to restrict a connector to their own domain. It restates `/.well-known/oauth-authorization-server` rather than configuring a second server: same `issuer`, endpoints, `openid`/`email`-inclusive scope catalog and S256-only PKCE rule, so a client reading either document reaches the same server. Public, unauthenticated, CORS-open and cached for one hour on the same terms as the other two `.well-known` documents.

**Deliberately missing two members OIDC Discovery marks REQUIRED: `jwks_uri` and `id_token_signing_alg_values_supported`.** Both describe how to verify an ID token, and this server issues none — identity is read from `GET/POST /oauth/userinfo` instead, which OpenAI's own documentation names as the mandatory half (the ID token is the alternative). An absent member fails honestly; a present and false one would not. `subject_types_supported: ["public"]` matches what `/oauth/userinfo` actually returns: the same subject to every client, never a pairwise identifier.

## Response `200`

OK

- object
  - `issuer` string, uri
  - `authorization_endpoint` string, uri
  - `token_endpoint` string, uri
  - `userinfo_endpoint` string, uri
  - `registration_endpoint` string, uri
  - `revocation_endpoint` string, uri
  - `response_types_supported` string[]
  - `grant_types_supported` string[]
  - `subject_types_supported` string[]: Always `["public"]` — the subject is the same `sub` for every client, never pairwise.
  - `code_challenge_methods_supported` string[]
  - `token_endpoint_auth_methods_supported` string[]
  - `scopes_supported` string[]
  - `claims_supported` string[]: Exactly the claims `/oauth/userinfo` can return, and no more.
  - `service_documentation` string, uri

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not found
- `429`: Rate limited

---

[API](https://skmtc.dev/elaichi/apis/elaichi-api.md) · [All operations](https://skmtc.dev/elaichi/apis/elaichi-api/llms.txt) · [OpenAPI document](https://skmtc.dev/elaichi/apis/elaichi-api/revisions/b22cfb7b6d15?raw)