Openid Configuration

OIDC discovery document.

Some SDKs fetch this to learn endpoint URLs. We advertise password + client_credentials + refresh_token grants and the HS256 signing alg.

Issuer + all endpoint URLs are derived from the configured PUBLIC base URL (base_url setting) or, failing that, the incoming request's base URL — so discovery is host-correct on dev/staging/prod instead of always pointing at the production host.

jwks_uri is intentionally omitted: we sign with HS256 (symmetric), so there is no public key to publish and an advertised JWKS would only mislead clients into attempting key-based verification.