OIDC Discovery Document Explorer

What is OIDC discovery?

OpenID Connect Discovery lets a client learn everything it needs about an OpenID Provider (endpoints, supported scopes, algorithms, and more) from one JSON document at a fixed, well-known path, rather than hardcoding each endpoint and capability. See the discovery endpoint in IdentityServer for how it's implemented server-side.

The /.well-known/openid-configuration path

Given an issuer URL, append /.well-known/openid-configuration to get the discovery document URL. This tool does that automatically when you provide just the issuer. Fetching can fail over CORS, since the server must send Access-Control-Allow-Origin for a browser to read the response. Discovery documents are meant to be public, so most servers allow this, but some gateways strip the header. Paste the JSON directly if that happens.

How clients use discovery documents

Libraries like ASP.NET Core's OpenID Connect handler fetch and cache the discovery document (and the JWKS it points to) automatically, refreshing periodically. This keeps client configuration in sync with server-side changes like key rotation or newly enabled features without a redeploy. A dpop_signing_alg_values_supported field in the document means the server supports DPoP (RFC 9449), which binds tokens to a client-held key so a stolen bearer token alone isn't enough to use it. Learn more about the differences between OAuth 2.0 and OpenID Connect.

Why issuer validation matters

OIDC Discovery §4.3 requires the issuer field inside the document to exactly match the URL used to fetch it. This tool checks that for you and flags a mismatch as a failure. A client that skips this check could be tricked into trusting the wrong server's keys.

JWK vs. discovery: where do keys come from?

The discovery document's jwks_uri points to the actual signing keys. Use the JWKS explorer to inspect them: key sizes, algorithms, thumbprints and PEM export.

Fetching discovery documents in .NET

Microsoft.IdentityModel.Protocols.OpenIdConnect handles fetching, caching and refreshing automatically:

using Microsoft.IdentityModel.Protocols;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;

var manager = new ConfigurationManager<OpenIdConnectConfiguration>(
    "https://your-issuer/.well-known/openid-configuration",
    new OpenIdConnectConfigurationRetriever());

var config = await manager.GetConfigurationAsync();
Console.WriteLine(config.TokenEndpoint);
Console.WriteLine(config.JwksUri);