Trust is the
first requirement.

Protocol essentials

• Use OpenID Connect Authorization Code flow with PKCE S256, unpredictable state, and OIDC nonce validation where applicable.
• Require exact redirect URI matches and strict CORS origins per registered application; no wildcards in production.
• Validate the identity provider’s discovery metadata and token signatures against the issuer’s rotating JWKs; check aud, iss, expiration, and permitted algorithms.
• Apply least-privilege scopes. Never expose server-only client secrets in browser code.
• Use HTTPS on all non-local issuer, redirect, and frontend origins. Enable safe cookie flags and host protections.

Production service requirements

• Persist the identity database on backed-up, encrypted storage and test restores.
• Enable email verification, trustworthy transactional email, password reset safeguards, and multifactor authentication options.
• Harden admin accounts (MFA), separate admin/public hostnames, restrict network exposure, and enable abuse throttling.
• Run the provider in production mode behind TLS with a fixed hostname and correct proxy headers; do not deploy start-dev.
• Maintain monitoring, security patching, disclosure process, incident response, data retention rules, and an accurate privacy notice.
• Review user consent UX, third-party client registration, token revocation, logout, and abuse/reporting processes.

Application requirements

• Use a robust OIDC client or the included SDK rather than manually constructing or decoding security-sensitive requests.
• Protect apps against XSS and CSRF, use a restrictive Content Security Policy, and avoid persisting access tokens indefinitely in browser storage.
• Verify access token authorization on resource servers; an ID token alone does not grant API access.
• For third-party applications, register unique public clients or confidential server clients and provide a key/secret rotation and revocation mechanism.