Token management

After receiving the authorization code from the authorization endpoint callback, make a backchannel POST request to the token endpoint with the authorization code, client ID, client secret, and redirect URI to receive the tokens.

Reference: OIDC token retrieval

Use the JWK Set from the jwks_uri endpoint to verify the ID Token signature. The endpoint provides public keys for RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, and PS512 algorithms.

Reference: ID token signature verification

Yes, implement caching for the jwks_uri response with a TTL of at least 1 hour to reduce unnecessary calls and improve performance.

Reference: OIDC jwks_uri response (JWK Set) caching

Use the refresh token with the token endpoint by including grant_type=refresh_token and the refresh token value. Note that refresh tokens are one-time use. Store the new refresh token returned in the response.

Reference: Refreshing a token

Make a POST request to the revocation endpoint with the token you want to revoke and specify the token_type_hint (either "access_token" or "refresh_token").

Reference: Revoking token