Discovery

The OpenID Connect discovery document, and what each endpoint in it is for.

Everything a client needs is in one JSON document at https://auth.latchkey.id/.well-known/openid-configuration. Any OpenID Connect library reads it; so can you.

curl -s https://auth.latchkey.id/.well-known/openid-configuration | jq .

Field	What it is for
issuer	the value in every token’s iss; also the org API’s base URL
authorization_endpoint	/oauth/authorize — where a browser or app starts a sign-in (code + PKCE)
token_endpoint	/oauth/token — code and refresh exchanges, client_credentials for machines, RFC 8693 token exchange
jwks_uri	the RS256 public keys, with kid, for verifying access tokens without a network call per request
userinfo_endpoint	the signed-in identity, for clients that would rather not decode the token
revocation_endpoint, end_session_endpoint	sign out one session, or the whole SSO session

Access tokens carry aud: "latchkey"; only the id_token carries your client id. Verify the signature against jwks_uri, the issuer, and the expiry, then read sub (the identity) and ns (namespace → level, scoped to your client’s org).