OIDC Endpoints Reference

Keycloak exposes a set of standard OpenID Connect and OAuth 2.0 endpoints for each Realm. All endpoints are discoverable via the OIDC discovery document.

Discovery Endpoint

GET https://<keycloak-host>/realms/<realm>/.well-known/openid-configuration

Returns a JSON document listing all available endpoints, supported scopes, grant types, signing algorithms, and other provider metadata.

Core Endpoints

Endpoint	URL	Description
Authorization	`/realms/<realm>/protocol/openid-connect/auth`	Initiates user authentication. Supports `response_type`: `code`, `id_token`, `token`.
Token	`/realms/<realm>/protocol/openid-connect/token`	Exchanges authorization codes, refresh tokens, or client credentials for tokens.
UserInfo	`/realms/<realm>/protocol/openid-connect/userinfo`	Returns claims about the authenticated user. Requires a valid access token.
JWKS	`/realms/<realm>/protocol/openid-connect/certs`	Returns the public keys used to verify token signatures (JWK Set format).
End Session (Logout)	`/realms/<realm>/protocol/openid-connect/logout`	Terminates the user's SSO session. Supports `id_token_hint` and `post_logout_redirect_uri`.
Token Introspection	`/realms/<realm>/protocol/openid-connect/token/introspect`	Returns the active/inactive status and claims of a token. Requires client authentication.
Token Revocation	`/realms/<realm>/protocol/openid-connect/revoke`	Revokes a refresh token or access token. Requires client authentication.

Registration and Management Endpoints

Endpoint	URL	Description
Dynamic Client Registration	`/realms/<realm>/clients-registrations/openid-connect`	OIDC Dynamic Client Registration endpoint. Requires an initial access token or valid bearer token.
Client Registration (Keycloak format)	`/realms/<realm>/clients-registrations/default`	Keycloak-specific client registration using Keycloak client representation format.

Device and Backchannel Endpoints

Endpoint	URL	Description
Device Authorization	`/realms/<realm>/protocol/openid-connect/auth/device`	Initiates the OAuth 2.0 Device Authorization Grant for input-constrained devices.
Backchannel Authentication (CIBA)	`/realms/<realm>/protocol/openid-connect/ext/ciba/auth`	Initiates Client Initiated Backchannel Authentication.

SAML Endpoints

Endpoint	URL	Description
SAML Descriptor	`/realms/<realm>/protocol/saml/descriptor`	Returns the IdP SAML metadata document (Entity Descriptor).
SAML SSO (Redirect)	`/realms/<realm>/protocol/saml`	SAML Single Sign-On endpoint (HTTP-Redirect and HTTP-POST bindings).

Admin REST API

Endpoint	URL	Description
Admin API Base	`/admin/realms/<realm>`	Base URL for the Keycloak Admin REST API. See Admin REST API.

Token Endpoint Authentication Methods

When calling the token endpoint, clients authenticate using one of:

Method	Description
`client_secret_post`	Client ID and secret sent as POST body parameters
`client_secret_basic`	Client ID and secret sent via HTTP Basic Authentication header
`client_secret_jwt`	Client authenticates with a JWT signed using the client secret (HMAC)
`private_key_jwt`	Client authenticates with a JWT signed using a private key (RSA/EC)
`none`	No client authentication (public clients, must use PKCE)

Supported Scopes

Scope	Claims Included
`openid`	`sub` (required for OIDC)
`profile`	`name`, `family_name`, `given_name`, `preferred_username`, `locale`
`email`	`email`, `email_verified`
`address`	`address`
`phone`	`phone_number`, `phone_number_verified`
`roles`	`realm_access.roles`, `resource_access.<client>.roles`
`microprofile-jwt`	`groups`, `upn`
`offline_access`	Requests a refresh token valid for offline access

#OIDC Endpoints Reference

#TOC

#Discovery Endpoint

#Core Endpoints

#Registration and Management Endpoints

#Device and Backchannel Endpoints

#SAML Endpoints

#Admin REST API

#Token Endpoint Authentication Methods

#Supported Scopes