OpenIddict — OAuth 2.0 and OpenID Connect Server for .NET

Introduction

OpenIddict provides a low-ceremony way to add an OAuth 2.0 / OpenID Connect authorization server to any ASP.NET Core application. Rather than forcing a specific architecture, it integrates into your existing app and lets you own the authentication logic while it handles the protocol plumbing.

What OpenIddict Does

• Implements OAuth 2.0 authorization code, client credentials, device, and refresh token flows
• Issues and validates JWT and opaque access tokens with configurable lifetimes
• Provides an OpenID Connect discovery endpoint for automatic client configuration
• Manages application registrations, scopes, and authorizations via a pluggable store
• Supports PKCE, token revocation, introspection, and custom grant types

Architecture Overview

OpenIddict is split into three layers: Core (entity management and stores), Server (protocol handling and token issuance), and Validation (token verification for resource servers). Each layer is a set of NuGet packages with optional adapters for Entity Framework Core, MongoDB, or custom stores. The server integrates as ASP.NET Core middleware, handling discovery, authorization, token, and userinfo endpoints.

Self-Hosting & Configuration

• Install the OpenIddict meta-package and an EF Core or MongoDB store adapter
• Register services with AddOpenIddict() and configure flows in the server options
• Use development certificates for local work; deploy with real X.509 certificates
• Seed client applications and scopes in your database migration or startup
• Mount endpoints at custom URLs or use the defaults (/connect/authorize, /connect/token)

Key Features

• Full OAuth 2.0 and OpenID Connect compliance with certification-ready defaults
• Pluggable storage: Entity Framework Core, MongoDB, or implement your own store
• Degraded mode for stateless deployments without a database
• Token format flexibility: JWT (self-contained) or reference tokens (opaque, server-validated)
• First-party client and validation libraries for resource server protection

Comparison with Similar Tools

• Duende IdentityServer — feature-rich but commercial license required for production; OpenIddict is free
• Keycloak — standalone Java identity server; OpenIddict embeds inside your ASP.NET app
• Auth0 / Okta — managed SaaS; OpenIddict is self-hosted with full control
• ORY Hydra — Go-based standalone server; OpenIddict is .NET-native and embeddable
• ASP.NET Core Identity — handles user management but not OAuth/OIDC server; OpenIddict adds the protocol layer

FAQ

Q: Is OpenIddict free for commercial use? A: Yes. OpenIddict is released under the Apache 2.0 license with no commercial restrictions.

Q: Can OpenIddict run without a database? A: Yes. Degraded mode allows stateless operation using JWT tokens without persistence, suitable for development or simple scenarios.

Q: Does OpenIddict support multi-tenant scenarios? A: You can implement multi-tenancy by customizing the application store or using separate DbContexts per tenant.

Q: How does OpenIddict differ from ASP.NET Core Identity? A: ASP.NET Core Identity handles user registration and login. OpenIddict adds OAuth 2.0 / OIDC protocol endpoints on top, enabling token issuance for APIs and third-party clients.

Sources

• https://github.com/openiddict/openiddict-core
• https://documentation.openiddict.com