oidc-provider

Spec sheet

Purpose

oidc-provider is an OpenID Certified OAuth 2.0 authorization server implementation for Node.js with OpenID Connect support.Read 7 Oct 2026 · github.com

Intended users

The security policy describes the library as intended for developers building OAuth 2.0 authorization servers and OpenID Connect providers.Read 7 Oct 2026 · github.com

Support

The README says the only way to guarantee feedback from the author and sole maintainer is to support the package through GitHub Sponsors.Read 7 Oct 2026 · github.com

License

The GitHub repository lists the project under the MIT license.Read 7 Oct 2026 · github.com

Configuration

The authorization server can be extended and configured for different uses, and not all features are enabled by default.Read 7 Oct 2026 · github.com

Experimental features

FAPI-CIBA, attestation-based client authentication, OAuth Client ID Metadata Documents, and OpenID for Verifiable Credential Issuance are listed as experimental.Read 7 Oct 2026 · github.com

Framework integrations

The provider can be mounted in connect, Express, Fastify, Hapi, and Koa applications.Read 7 Oct 2026 · github.com

Protocols

It implements OAuth 2.0, OpenID Connect, discovery, dynamic client registration, logout, token revocation, PKCE, introspection, device flow, and other specifications.Read 7 Oct 2026 · github.com

Resource limits

The security policy says the library does not implement resource limits and applications should provide their own rate limiting and resource management.Read 7 Oct 2026 · github.com

Security profiles

The project lists OpenID Connect certification for FAPI 1.0, FAPI CIBA, and FAPI 2.0 profiles, among others.Read 7 Oct 2026 · github.com

Security responsibilities

Users are responsible for securely storing, managing, and rotating cryptographic keys; storage adapter security depends on the adapter and storage system they choose.Read 7 Oct 2026 · github.com

Security updates

The security policy lists v9.x as supported for security updates and directs vulnerability reports through GitHub Security Advisories.Read 7 Oct 2026 · github.com

Token formats

It supports opaque and JWT access token formats.Read 7 Oct 2026 · github.com

Plans and prices

Every oidc-provider plan and price →

Where Specifiction places it

• OAuth Server Software#30 of 327.3