Configuration
=============

Available settings:

``IDP_OIDC_ACCESS_TOKEN_EXPIRES_IN`` (default: 3600)
  The time (in seconds) after which access tokens expire.

``IDP_OIDC_ACCESS_TOKEN_FORMAT`` (default: ``"opaque"``)
  The format of issued access tokens. This can be ``"opaque"`` for randomized
  strings, or, ``"jwt"`` for JWT based access tokens.

``IDP_OIDC_ADAPTER`` (default: ``"allauth.idp.oidc.adapter.DefaultOIDCAdapter"``)
  Specifies the adapter class to use, allowing you to alter certain
  default behavior.

``IDP_OIDC_AUTHORIZATION_CODE_EXPIRES_IN`` (default: 60)
  The time (in seconds) after which authorization codes expire.

``IDP_OIDC_DCR_ENABLED`` (default: ``False``)
  Controls whether Dynamic Client Registration is enabled. When enabled, clients
  can register themselves by POSTing to the registration endpoint.

``IDP_OIDC_DCR_REQUIRES_INITIAL_ACCESS_TOKEN`` (default: ``True``)
  When enabled, the DCR endpoint requires an initial access token in the
  ``Authorization`` header (``Bearer <token>``). This limits registration to
  previously authorized parties.

``IDP_OIDC_CIMD_CACHE_TIMEOUT`` (default: 3600)
  The time (in seconds) to cache fetched CIMD metadata before re-fetching.

``IDP_OIDC_CIMD_ENABLED`` (default: ``False``)
  Controls whether Client ID Metadata Document support is enabled. When enabled,
  clients can use an HTTPS URL as their ``client_id``.

``IDP_OIDC_DEVICE_CODE_EXPIRES_IN`` (default: 300)
  The time (in seconds) after which device codes expire.

``IDP_OIDC_DEVICE_CODE_INTERVAL`` (default: 5)
  The time (in seconds) a client should wait between polling attempts when using
  the device authorization flow.

``IDP_OIDC_ID_TOKEN_EXPIRES_IN`` (default: 300)
  The time (in seconds) after which ID tokens expire.

``IDP_OIDC_USER_CODE_FORMAT`` (default: ``settings.ALLAUTH_USER_CODE_FORMAT``)
  Controls the format of the user code.

``IDP_OIDC_PRIVATE_KEY`` (default: ``""``)
  A string containing the PEM-encoded private key used for signing ID tokens and
  JWT access tokens (and for serving ``.well-known/jwks.json``). This is the
  simplest way to configure a single signing key. For key rotation, use
  ``IDP_OIDC_PRIVATE_KEYS`` instead.

``IDP_OIDC_PRIVATE_KEYS`` (default: ``[]``)
  A list of private keys, used to support key rotation. Each entry is a
  dictionary describing a single key::

      IDP_OIDC_PRIVATE_KEYS = [
          {
              "pem": "-----BEGIN PRIVATE KEY-----\n...",
              "not_before": "2026-01-01T00:00:00+00:00",
              "expires_at": "2026-04-01T00:00:00+00:00",
              "issued_at": "2025-12-01T00:00:00+00:00",
          },
          ...
      ]

  The ``pem`` field (the PEM-encoded private key) is required. The
  ``not_before``, ``expires_at`` and ``issued_at`` fields are optional and may
  be passed either as ISO 8601 strings or as ``datetime`` objects (naive
  datetimes are interpreted as UTC).

  A key is published in ``.well-known/jwks.json`` and trusted for verifying
  tokens from the moment it is configured until its ``expires_at`` is reached
  (``not_before`` does not affect this -- keys are pre-published so clients can
  pick them up ahead of time). New tokens are always signed with the most
  recently *issued* key (``issued_at``, falling back to ``not_before``) that has
  activated and not yet expired.

  To rotate, add the new key with a later ``issued_at`` than the incumbent;
  signing switches to it automatically. Set an ``expires_at`` on the previous
  key far enough in the future that every token it signed has expired (and the
  JWKS cache window has elapsed) before it is removed. Until then the old key
  remains verify-only.

  Any key configured via ``IDP_OIDC_PRIVATE_KEY`` is automatically included in
  this list (without ``issued_at``), so it is treated as the oldest key and any
  dated key in ``IDP_OIDC_PRIVATE_KEYS`` takes over signing.

``IDP_OIDC_JWKS_CACHE_CONTROL`` (default: 3600)
  Controls the cache control max age (in seconds) of the ``.well-known/jwks.json``
  response. The value is automatically clamped so that it never exceeds the time
  until the next key drops out of the key set (the soonest ``expires_at``),
  ensuring clients refetch before a key they may still rely on is removed.


``IDP_OIDC_RATE_LIMITS`` (default: ``{...}``)
  Rate limit configuration, defaulting to::

      {
       "device_user_code": "5/m/ip",
       "client_registration": "3/m/ip",
       "cimd_fetch": "3/m/ip",
       "introspect_ip": "30/m/ip",
       "introspect_client": "60/m/key",
      }

  The introspection endpoint is throttled by two independent limits:
  ``introspect_ip`` is enforced per source IP before client authentication, so
  that unauthenticated and failed-authentication requests are bounded too, while
  ``introspect_client`` is enforced per authenticated client afterwards.

``IDP_OIDC_AUTH_METHODS`` (default: ``["client_secret_basic", "client_secret_post", "none"]``)
  The authentication methods supported by the token, device authorization and
  revocation endpoints.  Currently supported values are ``client_secret_basic``,
  ``client_secret_post`` and ``none`` (public clients).

``IDP_OIDC_INTROSPECTION_ENABLED`` (default: ``False``)
  Controls whether the token introspection endpoint is enabled. When enabled,
  clients can introspect tokens by POSTing to the token introspection endpoint.

``IDP_OIDC_INTROSPECTION_AUTH_METHODS`` (default: ``["client_secret_basic", "client_secret_post"]``)
  The authentication methods supported by the introspection endpoint.  Currently
  supported values are ``client_secret_basic``, ``client_secret_post`` and
  ``none`` (public clients).

``IDP_OIDC_INTROSPECTION_CROSS_CLIENT_ALLOWED`` (default: ``False``)
  Controls whether an authenticated client may introspect tokens issued to
  *other* clients. An introspection response exposes metadata such as ``sub``,
  ``scope``, ``aud`` and ``client_id``, so by default (``False``) a caller may
  only introspect its own tokens; any other token yields ``{"active": false}``,
  indistinguishable from an unknown one (as RFC 7662 requires). Enable only if
  you intentionally rely on shared introspection; combine it with the adapter's
  ``is_introspection_allowed`` to narrow cross-client access (e.g. to callers
  listed in the token's audience).

``IDP_OIDC_REFRESH_TOKEN_EXPIRES_IN`` (default: ``None``)
  Set to a positive number of seconds to make refresh tokens expire. By
  default (``None``) refresh tokens do not expire. With
  ``IDP_OIDC_ROTATE_REFRESH_TOKEN`` enabled, each rotation issues a fresh
  token carrying a new expiry, resulting in a sliding (inactivity) window.
  With rotation disabled, the refresh token -- and its original expiry -- is
  reused as is, so the value acts as an absolute lifetime. Refresh tokens
  issued before this setting was enabled are unaffected by it. Whenever a
  refresh token carries an expiry, its remaining lifetime is returned to the
  client as ``refresh_expires_in`` (seconds) in the token response. Expired
  tokens are rejected, but not automatically purged from the database.

``IDP_OIDC_ROTATE_REFRESH_TOKEN`` (default: ``True``)
  When access tokens are refreshed the old refresh token can be kept
  (``False``) or replaced (``True``) with a new one (rotated).

``IDP_OIDC_RP_INITIATED_LOGOUT_ASKS_FOR_OP_LOGOUT`` (default: ``True``)
  During the RP initiated logout, the OIDC specification recommends that the end
  user is asked whether or not to logout of the OP as well. When this setting is
  ``True``, the end user is always asked. When ``False``, the user is only asked
  if needed according to the specification.

``IDP_OIDC_USERINFO_ENDPOINT`` (default: ``None``)
  This setting can be used to point the ``userinfo_endpoint`` value as returned
  in the ".well-known/openid-configuration" to a custom URL.  Setting this
  disables the built-in userinfo endpoint.
