oidc-integration
Installation
SKILL.md
OIDC Integration for Inference Engines
Security Requirement
Inference engines MUST integrate with external OIDC Identity Providers (e.g., Keycloak) for authentication. They MUST consume tokens issued by the IdP directly and support discovery via /.well-known/openid-configuration.
Raw API key authentication alone is not acceptable for production inference engines.
Required Grant Types
The inference engine MUST support these OAuth 2.0/OIDC grants from the IdP:
| Grant Type | Use Case |
|---|---|
authorization_code + PKCE |
Human users via interactive browser flows |
client_credentials |
Service accounts and automated workloads |
device_code |
CLI tools and headless environments |
| OIDC-A extensions | LLM agents chaining calls across services |