OIDC login

When users sign in at Keycloak, Auth0, Okta, Entra ID or Google, the API only checks their tokens, as an OAuth2 resource server:

Terminalsh

dygo g security -oidc

Terminalsh

OAUTH_ISSUER_URL=https://auth.example.com/realms/shop
OAUTH_AUDIENCE=shop-api
OAUTH_ROLES_CLAIM=realm_access.roles      # Keycloak; the default is roles

At startup the app reads <issuer>/.well-known/openid-configuration and the provider’s keys (JWKS). It accepts RS256 and ES256 tokens from that issuer for that audience, and checks exp and nbf. Roles come from OAUTH_ROLES_CLAIM, the token’s scopes (scope or scp) become authorities, and p.Claims has every claim. When the provider rotates its keys, the first token with a new key makes the app fetch the keys again.

There are no register, login, refresh or logout routes in this mode; GET /auth/me shows what the token says. Rules, route options, Require and the generators work the same. In production the issuer must use https and OAUTH_AUDIENCE must be set, or the app does not start.