---
title: auth-oidc
description: Expose the Host as an OpenID Connect provider backed by auth sessions.
---

Install `auth-oidc` when another application needs to authenticate through the
Host's existing users and sessions. It depends on `auth`.

```sh
lenso module install auth
lenso module install auth-oidc
cargo run --bin migrate
lenso serve
```

The module contributes these endpoints:

- `/.well-known/openid-configuration`
- `/.well-known/jwks.json`
- `/oauth/authorize`
- `/oauth/token`

It is installed but disabled until complete module-local configuration is
provided:

```sh
LENSO_MODULE_AUTH_OIDC__ENABLED=true
LENSO_MODULE_AUTH_OIDC__ISSUER=https://app.example.com
LENSO_MODULE_AUTH_OIDC__CONSOLE_REDIRECT_URIS='["https://client.example.com/oidc/callback"]'
LENSO_MODULE_AUTH_OIDC__JWKS='{"keys":[...]}'
LENSO_MODULE_AUTH_OIDC__ID_TOKEN_PRIVATE_KEY_PEM="$OIDC_SIGNING_KEY_PEM"
```

The client id defaults to `lenso-console`. Every redirect URI must match an
allowed URI exactly and must not contain a fragment. Keep the private signing
key in the Host's secret store; publish only its matching public key through
JWKS.

The independent Lenso Console Service owns its own operator identities. Adding
`auth-oidc` to a business Host does not grant a business user Console access.