a6-plugin-openid-connect

Overview

The openid-connect plugin integrates APISIX with external OpenID Connect identity providers (Keycloak, Auth0, Okta, etc.). It supports the full authorization code flow for browser-based applications, bearer token validation for API clients, and token introspection or local JWKS verification.

From APISIX 3.18.0 the plugin also supports nested PAR and DPoP configuration, forwards the raw ID token when set_raw_id_token_header is enabled, fails closed when the trusted issuer cannot be determined, treats claim_validator.audience.match_with_client_id as requiring an audience claim, and enforces required_scopes on authorization-code sessions. For bearer JWT validation, configure claim_validator.issuer.valid_issuers when discovery can be unavailable.