# OpenIddict — OAuth 2.0 and OpenID Connect Server for .NET

> OpenIddict is a flexible open-source framework for implementing OAuth 2.0 and OpenID Connect server functionality in ASP.NET Core applications, supporting authorization code, client credentials, device, and custom grant flows.

## Install

Save as a script file and run:

# OpenIddict — OAuth 2.0 and OpenID Connect Server for .NET

## Quick Use
```bash
dotnet add package OpenIddict
dotnet add package OpenIddict.EntityFrameworkCore
```
```csharp
builder.Services.AddOpenIddict()
    .AddCore(o => o.UseEntityFrameworkCore().UseDbContext<AppDbContext>())
    .AddServer(o => {
        o.AllowClientCredentialsFlow();
        o.SetTokenEndpointUris("/connect/token");
        o.AddDevelopmentEncryptionCertificate()
         .AddDevelopmentSigningCertificate();
        o.UseAspNetCore().EnableTokenEndpointPassthrough();
    });
```

## Introduction
OpenIddict provides a low-ceremony way to add an OAuth 2.0 / OpenID Connect authorization server to any ASP.NET Core application. Rather than forcing a specific architecture, it integrates into your existing app and lets you own the authentication logic while it handles the protocol plumbing.

## What OpenIddict Does
- Implements OAuth 2.0 authorization code, client credentials, device, and refresh token flows
- Issues and validates JWT and opaque access tokens with configurable lifetimes
- Provides an OpenID Connect discovery endpoint for automatic client configuration
- Manages application registrations, scopes, and authorizations via a pluggable store
- Supports PKCE, token revocation, introspection, and custom grant types

## Architecture Overview
OpenIddict is split into three layers: Core (entity management and stores), Server (protocol handling and token issuance), and Validation (token verification for resource servers). Each layer is a set of NuGet packages with optional adapters for Entity Framework Core, MongoDB, or custom stores. The server integrates as ASP.NET Core middleware, handling discovery, authorization, token, and userinfo endpoints.

## Self-Hosting & Configuration
- Install the OpenIddict meta-package and an EF Core or MongoDB store adapter
- Register services with `AddOpenIddict()` and configure flows in the server options
- Use development certificates for local work; deploy with real X.509 certificates
- Seed client applications and scopes in your database migration or startup
- Mount endpoints at custom URLs or use the defaults (/connect/authorize, /connect/token)

## Key Features
- Full OAuth 2.0 and OpenID Connect compliance with certification-ready defaults
- Pluggable storage: Entity Framework Core, MongoDB, or implement your own store
- Degraded mode for stateless deployments without a database
- Token format flexibility: JWT (self-contained) or reference tokens (opaque, server-validated)
- First-party client and validation libraries for resource server protection

## Comparison with Similar Tools
- **Duende IdentityServer** — feature-rich but commercial license required for production; OpenIddict is free
- **Keycloak** — standalone Java identity server; OpenIddict embeds inside your ASP.NET app
- **Auth0 / Okta** — managed SaaS; OpenIddict is self-hosted with full control
- **ORY Hydra** — Go-based standalone server; OpenIddict is .NET-native and embeddable
- **ASP.NET Core Identity** — handles user management but not OAuth/OIDC server; OpenIddict adds the protocol layer

## FAQ
**Q: Is OpenIddict free for commercial use?**
A: Yes. OpenIddict is released under the Apache 2.0 license with no commercial restrictions.

**Q: Can OpenIddict run without a database?**
A: Yes. Degraded mode allows stateless operation using JWT tokens without persistence, suitable for development or simple scenarios.

**Q: Does OpenIddict support multi-tenant scenarios?**
A: You can implement multi-tenancy by customizing the application store or using separate DbContexts per tenant.

**Q: How does OpenIddict differ from ASP.NET Core Identity?**
A: ASP.NET Core Identity handles user registration and login. OpenIddict adds OAuth 2.0 / OIDC protocol endpoints on top, enabling token issuance for APIs and third-party clients.

## Sources
- https://github.com/openiddict/openiddict-core
- https://documentation.openiddict.com

---
Source: https://tokrepo.com/en/workflows/asset-8b98b94a
Author: Script Depot