A hosted OIDC provider for every client of your product
An OIDC provider, or OpenID Connect provider, is the server your applications send users to for sign-in and that hands back signed tokens saying who the user is. The Skycloak Platform gives each of your tenants its own OIDC provider, run for you, so your web app, mobile app and APIs can all trust the same sign-in.
What an OIDC provider gives your applications
OpenID Connect is a thin identity layer on top of OAuth 2.0. Your application redirects the user to the provider, the user signs in there, and the application receives an ID token, which describes the user, and an access token, which your APIs accept as proof of access. Both are JSON Web Tokens signed with keys that the provider publishes, so any service can check them without calling back.
Each tenant on the Platform has its own issuer address and its own discovery document, the well-known file that tells a client library where the authorization, token and key endpoints are. Pointing a standard client at that issuer is usually all the configuration it needs.
The flows the Platform is built around
Web and mobile applications use the authorization code flow with PKCE, the current recommendation for every kind of client, including those that cannot keep a secret. The Platform follows OAuth 2.1, which drops the older implicit and password flows that are no longer considered safe.
Pushed authorization requests, DPoP sender-constrained tokens and private key JWT client authentication are on the plan for the first release, for teams whose customers ask for those stronger protections. Signing keys are rotated by the Platform and published in the key set before they are used, so your services pick up a new key without a deploy.
Why run it as a service
An OIDC provider is small in code but large in responsibility: if its signing keys leak or it goes down, nobody signs in to anything. Running it yourself means owning key storage, rotation, the database of users and sessions and the patching of every dependency, around the clock.
On the Platform that work is Skycloak's. Your tenant runs in the United States or the European Union, kept apart from other tenants by the database itself, and your team works with the standard protocol rather than with the server behind it.
Frequently asked questions
Can I use the client library I already have?
Yes. Any certified or widely used OpenID Connect client library works, because the Platform publishes a standard discovery document for each tenant.
Does each of my environments get its own issuer?
Yes. Each environment is a tenant with its own issuer, users and keys, so tokens from your staging tenant are never accepted by production.
See the Skycloak Platform for yourself
Book a demo and we will walk you through the Platform with your own sign-in flows in mind.