OIDC reference
Endpoints, claims, security profiles and lifetimes.
Versine is the OpenID Provider; the platform's Auth0 is its client. Internal
/trpc is not a public identity protocol. Discover the configured issuer at
https://auth.versine.com/.well-known/openid-configuration.
| Endpoint | Purpose |
|---|---|
/authorize | Authorization-code request |
/token | Confidential code exchange |
/jwks | Public signing keys |
/userinfo | Scoped profile |
/revoke | Token revocation |
/interaction/… | Browser-bound interaction UI, not a public approval API |
Use discovery instead of hardcoding endpoints. The legacy /auth, /me,
public-client registration and partner-token interfaces are not the current contract.
PAR is not advertised because it is not mounted.
Claims
| Scope | Profile fields |
|---|---|
openid | sub |
email | email, email_verified |
profile | name, given_name, family_name, https://versine.com/claims/provider |
The provider value is versine. The URL-shaped claim name is an identifier,
not a navigation link; it does not change to localhost. Do not promise an
amr: ["agent"] value from the old implementation.
Validate signature, issuer, audience, expiry and expected nonce using a mature OIDC
library. The stable upstream identity is the pair (iss, sub), not email.
Auth0 issues its own downstream identity and issuer. OIDC Core
Security profiles
S256 PKCE is the default. The explicit confidential nonce profile requires fresh state/nonce and broker verification. All registered callbacks are exact HTTPS Auth0 callbacks. Only authorization-code response type is enabled.
Current lifetimes
| Artifact | Lifetime |
|---|---|
| Authorization code | 60 seconds |
| Access token / ID token | 300 seconds |
| Interaction / provider session / grant | 600 seconds |
| MCP connection bearer | 90 days, unless revoked |
Expiry is not a promise that every audit/database record is deleted at that time. Revoking a Versine relationship stops future Versine authorization; an already-issued broker/application session must be ended under that platform's own controls.