OIDC Discovery Document
The discovery document
Section titled “The discovery document”Every Keycloak realm publishes an OpenID Connect discovery document at /.well-known/openid-configuration under /realms/<realm>.
Full URL:
https://<keycloak-host>/realms/<realm>/.well-known/openid-configurationThis is the single source of truth for every endpoint your app needs. Fetch it once at startup and you have everything — authorization endpoint, token endpoint, JWKS URI, and more.
Key endpoints in the discovery document
Section titled “Key endpoints in the discovery document”| Endpoint name | JSON key | Purpose |
|---|---|---|
| Authorization endpoint | authorization_endpoint | Redirects users to the login page |
| Token endpoint | token_endpoint | Exchanges codes for tokens |
| UserInfo endpoint | userinfo_endpoint | Returns claims about the authenticated user |
| JWKS URI | jwks_uri | Public keys for verifying JWT signatures |
| End session endpoint | end_session_endpoint | Logs the user out |
Fetching the discovery document
Section titled “Fetching the discovery document”Replace KC_URL and REALM with your values. The response is a JSON object with all the endpoint URLs listed above.
curl https://${KC_URL}/realms/${REALM}/.well-known/openid-configuration | jq .