See openid-connect Menu

Get an OIDC ID Token


Use this API to authenticate a user as part of the OpenID Connect Implicit Flow and generate an ID Token for the user.

For more detail about the Implicit Flow see our Developer Overview for OpenID Connect.

Resource URL

https://<subdomain>.onelogin.com/oidc/auth?client_id=<client id>&redirect_uri=<redirect uri>&response_type=id_token&scope=openid

Resource Parameter

subdomain

required

integer

Set to the subdomain of your OneLogin instance.

e.g. oidc-sample where the instance is https://oidc-sample.onelogin.com

Request Parameter

subdomain

required

integer

Set to the subdomain of your OneLogin instance.

e.g. oidc-sample where the instance is https://oidc-sample.onelogin.com

redirect_uri

required

string

The redirect uri that is registered with OneLogin for this OpenId Connect app.

response_type

required

string

Set to “code”

scope

required

string

Set to “openid”

nonce

required

string

A secure random string that is used by the OpenID provider to protect against replay attacks. It will be returned as part of the JWT ID Token and should be used to validate the authenticity of the token.

state

string

A random string that is returned on success and can be used to verify the call and protect against cross site scripting attacks.

Sample Response

If the request parameters are valid a 302 redirect will occur to the registered redirect_uri with the following query parameters appended.

Success - Providing the id_token is validated

#id_token=xxxxxx.xxxxxxxxxxxx.xxxxxxxxxx&state=aff55f6cf1d50e75988db51fe7746546

Error - Invalid Response Type

?error=unsupported_response_type&error_description=response_type%20not%20supported

Error - Missing the scope parameter

?error=invalid_request&error_description=missing%20required%20parameter(s)%20scope

Missing the nonce

{
    "error": "invalid_request",
    "error_description": "missing required parameter(s). (nonce)"
}

Missing the redirect_uri

{
    "error": "invalid_request",
    "error_description": "missing required parameter(s). (redirect_uri)"
}

Invalid redirect_uri

{
    "error": "redirect_uri_mismatch",
    "error_description": "redirect_uri did not match any client's registered redirect_uri"
}

Invalid client_id

{
    "error": "invalid_client",
    "error_description": "client is invalid",
    "state": "61c07cd68b0c65a0e9a35bf6c4f472f4"
}

Response Elements

id_token A JWT containing user information and nonce for validation
state The state parameter provided in the initial request to help prevent cross site scripting attacks

Have a Question?

Have a how-to question? Seeing a weird error? Ask us about it on StackOverflow.

Found a bug? Submit a support ticket.

Have a product idea or request? Share it with us in our Ideas Portal.