Reference

OpenID Connect

Not using PHP? Identvia is a standard OpenID Connect provider. Use any certified library and point it at the issuer below.

Discovery

Rules Identvia enforces

• Authorization code flow only (response_type=code). No implicit or hybrid flow.
• PKCE with S256 is required for every client, confidential ones included.
• Redirect URIs match exactly, character for character. No wildcards, no fragments. http://localhost only in Development environments.
• Authorization codes are single use and expire after 60 seconds. Reusing a code revokes the tokens it produced.
• ID tokens are signed with RS256. Access tokens last 10 minutes. Refresh tokens (scope offline_access) rotate on every use; replaying an old one revokes the whole chain.
• The callback includes iss (RFC 9207). Check it.
• sub is pairwise: each app sees a different, stable ID for the same person.

1. Authorization request

GET https://id.identvia.com/oauth/authorize
  ?response_type=code
  &client_id=oid_…
  &redirect_uri=https%3A%2F%2Fexample.com%2Fcallback
  &scope=openid%20email%20profile
  &state=<random, 32+ bytes>
  &nonce=<random, 32+ bytes>
  &code_challenge=<BASE64URL(SHA256(code_verifier))>
  &code_challenge_method=S256

Optional: prompt=none|login|consent, max_age, login_hint.

2. Token request

POST https://id.identvia.com/oauth/token
Authorization: Basic base64(client_id:client_secret)
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code&code=…&redirect_uri=https%3A%2F%2Fexample.com%2Fcallback&code_verifier=…

Public clients send client_id in the body instead of a secret.

{
  "token_type": "Bearer",
  "access_token": "eyJ…",
  "expires_in": 600,
  "id_token": "eyJ…",
  "refresh_token": "…",          // only with offline_access
  "scope": "openid email profile"
}

3. Validate the ID token

1. Verify the signature with the key from the JWKS whose kid matches. Accept only RS256.
2. iss equals https://id.identvia.com; aud contains your client ID; azp, if present, is your client ID.
3. exp is in the future and iat is not (allow a minute of skew).
4. nonce equals the one you sent.
5. If you sent max_age, check auth_time.

Claims

Users choose what to share on the consent screen, so a scope you asked for may still come back without its claims. Handle that.