Quiz Entry - updated: 2026.10.22
Which endpoints does an OpenID Provider offer, and what is each one for?
The authorization endpoint (user authenticates and consents), the token endpoint (code or refresh token exchanged for tokens), the UserInfo endpoint (claims about the user, accessed with the access token) and the logout endpoint (ends the user's session at the OP).
| Endpoint | Called by | Channel | Purpose |
|---|---|---|---|
| Authorization | The browser, redirected by the RP | Front channel | Authenticates the user and obtains their consent; returns the authorization code. |
| Token | The RP's backend | Back channel | Exchanges the authorization code for ID token and access token (optionally refresh token) with grant_type=authorization_code; also exchanges a refresh token for a new access token with grant_type=refresh_token. |
| UserInfo | The RP's backend, with the access token | Back channel | An OAuth-protected API that returns the claims about the user that the client may access. |
| Logout (end session) | The browser, redirected by the RP | Front channel | Ends the user's session at the OP (initiates a logout there). |
Further endpoints exist, for example the JWKS URI that publishes the OP's public signing keys, and the discovery document that lists all of the above. A useful pattern: the endpoints the user has to see (authorization, logout) are reached through the browser; the endpoints that hand out or use tokens (token, UserInfo) are called server to server.
Go deeper:
OpenID Connect Core 1.0: Token Endpoint — the token request and response, including the ID token.- OpenID Connect Core 1.0: UserInfo Endpoint — the request, response and validation rules for user claims.