Everything a client library needs.

Send the browser here to start a login. Append /{provider} to pick one.

Exchange an authorization code for an id_token. Server-side.

Read the same claims again with a bearer access token.

Public keys for verifying an id_token signature.

Register a client. Unauthenticated; add ?format=env for dotenv output.

PKCE is required of every client. Holding a client secret is not an exemption — a leaked secret alone must not be enough to finish a flow. There is no plain path.

Both carry a secret. Every client here is confidential, so none is refused at registration rather than offered — a secretless client had no consumer, and it was the one shape where a mis-directed authorization code becomes a usable token.

Each client sees a different, stable sub for the same person, so two applications cannot correlate their users.