---
title: "Openid Configuration"
method: GET
path: "/realms/public/.well-known/openid-configuration"
tags: ["auth-keycloak"]
---

# Openid Configuration

`GET /realms/public/.well-known/openid-configuration`

## Request

- Base URL: `https://api.geopera.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.geopera.com/realms/public/.well-known/openid-configuration`
- Auth: none required

OIDC discovery document.

Some SDKs fetch this to learn endpoint URLs. We advertise password +
client_credentials + refresh_token grants and the HS256 signing alg.

Issuer + all endpoint URLs are derived from the configured PUBLIC base URL
(`base_url` setting) or, failing that, the incoming request's base URL —
so discovery is host-correct on dev/staging/prod instead of always
pointing at the production host.

`jwks_uri` is intentionally omitted: we sign with HS256 (symmetric), so
there is no public key to publish and an advertised JWKS would only mislead
clients into attempting key-based verification.

## Response `200`

Successful Response

- unknown

## Other responses

- `401`: Unauthorized
- `403`: Forbidden
- `404`: Not Found
- `422`: Validation Error
- `500`: Internal Server Error

---

[API](https://skmtc.dev/geopera/apis/geopera-data-platform.md) - [All operations](https://skmtc.dev/geopera/apis/geopera-data-platform/llms.txt) - [OpenAPI document](https://skmtc.dev/geopera/apis/geopera-data-platform/revisions/47981e2bd969?raw)