OIDC Discovery

Endpoint

GET https://auth.merion.com.au/.well-known/openid-configuration

Authentication

None required — this is a public discovery document

Response type

application/json

Purpose

Allows OIDC client libraries and integrators to auto-configure authentication parameters rather than hardcoding individual endpoint URLs.

Example

curl -s https://auth.merion.com.au/.well-known/openid-configuration | python3 -m json.tool

Key fields

issuer

https://auth.merion.com.au — the canonical issuer URI. Every ID token you receive must have an iss claim that exactly matches this value. Reject tokens where iss does not match.

authorization_endpoint

The URL to which users are redirected to authenticate. Use this value — do not hardcode the URL.

token_endpoint

The URL to POST to when exchanging an authorisation code for tokens, or refreshing tokens. Read from this field.

userinfo_endpoint

Endpoint to retrieve identity claims for the authenticated user using the access token.

jwks_uri

Endpoint serving the JSON Web Key Set (JWKS). Fetch the public keys from here to verify ID token signatures (ES256). Most OIDC libraries fetch and cache this automatically.

response_types_supported

Includes "code" — the authorisation code flow.

grant_types_supported

Includes "authorization_code" and "refresh_token".

id_token_signing_alg_values_supported

["ES256"] — ECDSA with P-256 and SHA-256. All ID tokens are signed with ES256.

code_challenge_methods_supported

["S256"] — PKCE with SHA-256. Plain PKCE is not supported.

scopes_supported

Includes at minimum "openid" and "profile".

Using the discovery document in client libraries

Most conformant OIDC client libraries accept an issuer URL and fetch the discovery document automatically at initialisation. Pass the issuer URL rather than individual endpoint URLs:

// Pseudocode — most OIDC libraries work this way
const client = new OidcClient({
  issuer: "https://auth.merion.com.au",
  clientId: "your-client-id",
  redirectUri: "https://your-app/callback",
  // The library fetches .well-known/openid-configuration automatically
  // and reads authorization_endpoint, token_endpoint, jwks_uri, etc.
});

The library will typically cache the discovery document for the duration of the process and refresh it periodically. Do not disable this caching — it is intentional.

Important: do not hardcode endpoint URLs

Always read endpoint URLs dynamically from the discovery document at startup. Do not hardcode the authorization_endpoint, token_endpoint, or jwks_uri values in your application — they may change during infrastructure updates, and the discovery document is the authoritative source.

The one value that is stable and safe to reference in documentation is the issuer: https://auth.merion.com.au. This is the value you validate against in ID token verification.

Related pages

For the full OIDC/PKCE authentication walkthrough, see Authentication. For a consolidated endpoint quick-reference, see API Reference.