Skip to content

OIDC Discovery Document

Every Keycloak realm publishes an OpenID Connect discovery document at /.well-known/openid-configuration under /realms/<realm>.

Full URL:

https://<keycloak-host>/realms/<realm>/.well-known/openid-configuration

This is the single source of truth for every endpoint your app needs. Fetch it once at startup and you have everything — authorization endpoint, token endpoint, JWKS URI, and more.

Endpoint nameJSON keyPurpose
Authorization endpointauthorization_endpointRedirects users to the login page
Token endpointtoken_endpointExchanges codes for tokens
UserInfo endpointuserinfo_endpointReturns claims about the authenticated user
JWKS URIjwks_uriPublic keys for verifying JWT signatures
End session endpointend_session_endpointLogs the user out

Replace KC_URL and REALM with your values. The response is a JSON object with all the endpoint URLs listed above.

curl https://${KC_URL}/realms/${REALM}/.well-known/openid-configuration | jq .
Where does Keycloak publish the OIDC discovery document?
Which JSON key in the discovery document gives you the token endpoint?
What is the JWKS URI used for?
Why should apps fetch the discovery document instead of hardcoding endpoints?