Provider model and configuration reference

This page covers Everlock's OAuth 2 and OpenID Connect provider model.

The OAuth backend runs behind frontend-http and uses an Everlock versioned-storage store for client registrations, signing keys, and issued tokens.

What it provides

issues access and ID tokens against Everlock users
stores clients, codes, and keys in a dedicated versioned store
login flow runs through the HTTP frontend
the standard /authorize, /token, /jwks, and discovery endpoints
Everlock user authentication during the login step
per-instance configuration via config/oauth-http.toml in the system store
an RSA signing key generated on first use and kept in the store, with tokens signed RS256 and the public half served from the JWKS endpoint

Configuration

Key	Description
`enabled`	Whether the backend starts at all
`store`	Versioned store name used for this OAuth instance
`issuer_url`	OIDC issuer URL and token `iss` value

CLI flags follow the standard naming:

--backend-oauth-http
--backend-oauth-http-store
--backend-oauth-http-issuer-url