Provider model and configuration reference

This page covers Everlock's OAuth 2 and OpenID Connect provider model.

The OAuth backend runs behind frontend-http and uses an Everlock versioned-storage store for client registrations, signing keys, and issued tokens.

What it provides

issues access and ID tokens against Everlock users
stores clients, codes, and keys in a dedicated versioned store
login flow runs through the HTTP frontend
the standard /authorize, /token, /jwks, and discovery endpoints
Everlock user authentication during the login step
per-instance configuration via config/oauth-http.toml in the system store
ECDSA and RSA signing keys generated and rotated through the store

Configuration

Key	Description
`enabled`	Whether the backend starts at all
`store`	Versioned store name used for this OAuth instance
`issuer_url`	OIDC issuer URL and token `iss` value

CLI flags follow the standard naming:

--backend-oauth-http
--backend-oauth-http-store
--backend-oauth-http-issuer-url