Keystone OIDC
Keystone OIDC transforms your WordPress installation into a fully-featured OpenID Connect (OIDC) identity provider , allowing other applications to authenticate users via your WordPress user database. Key Features OIDC Authorization Code Flow with PKCE support RS256 JWT signed access tokens and ID t
Keystone OIDC transforms your WordPress installation into a fully-featured OpenID Connect (OIDC) identity provider , allowing other applications to authenticate users via your WordPress user database.
Key Features
- OIDC Authorization Code Flow with PKCE support
- RS256 JWT signed access tokens and ID tokens
- Admin UI to create and manage multiple OIDC clients
- Client secret management – generate and reset secrets securely (shown only once)
- OIDC Discovery endpoint ( /wenisch-tech/keystone-oidc/.well-known/openid-configuration ) for automatic client configuration
- Standard scopes : openid , profile , email
- Refresh tokens for long-lived sessions
- Zero additional configuration after install – just create a client and you’re ready
Quick Start
- 01Install and activate the plugin
- 02Go to OIDC Provider → Add Client in your WordPress admin
- 03Enter your application name and redirect URI(s)
- 04Copy the generated Client ID and Client Secret (shown once)
- 05Configure your OIDC client application with the discovery URL shown in the settings
Endpoints
All URLs are relative to your WordPress site root.
- Discovery: /wenisch-tech/keystone-oidc/.well-known/openid-configuration
- Authorization: /wenisch-tech/keystone-oidc/oauth/authorize
- Token: /wenisch-tech/keystone-oidc/oauth/token
- UserInfo: /wenisch-tech/keystone-oidc/oauth/userinfo
- JWKS: /wenisch-tech/keystone-oidc/oauth/jwks
Compatibility aliases are also routed under /wenisch-tech/keystone-oidc/protocol/openid-connect/* for clients that still derive Keycloak-style paths from the custom issuer URI. These aliases are not advertised in discovery.
