OIDC connections get PKCE, Private Key JWT, and self-serve configuration

OIDC SSO connections used to be one-size-fits-all: claims came from the ID token, the token endpoint always authenticated with a client secret, and there was no way to update credentials after setup. Rotating an expired or compromised secret meant resetting the entire connection.

OIDC connections now support per-connection settings:

• PKCE (RFC 7636): opt in for identity providers that require or recommend proof-key code exchange.
• User info endpoint: fetch user profile claims from the userinfo endpoint instead of the ID token, for IdPs that keep ID tokens minimal.
• Token endpoint authentication method: choose client_secret_basic, client_secret_post, or private_key_jwt. With private_key_jwt, WorkOS provisions a signing key pair and offers the public certificate for download, so no shared secret changes hands.
• ID token signing algorithm: pin the algorithm you expect (RS256 by default), and tokens signed with anything else fail verification.

IT admins can also update a connection's client ID and client secret from the Admin Portal after setup. The edit takes two clicks and applies immediately, with no need to go back through the setup wizard.

Read the docs for setup details on each option.