Custom OIDC Provider

Claudio supports a custom OpenID Connect provider for self-hosted identity systems such as Authentik, Authelia, and Pocket ID.

Environment Variables

CLAUDIO_OIDC_SLUG=authentik
CLAUDIO_OIDC_DISPLAY_NAME=Authentik
CLAUDIO_OIDC_LOGO_URL=https://auth.example.com/static/dist/assets/icons/icon.png
CLAUDIO_OIDC_DISCOVERY_URL=https://auth.example.com/application/o/claudio/.well-known/openid-configuration
CLAUDIO_OIDC_CLIENT_ID=your_oidc_client_id
CLAUDIO_OIDC_CLIENT_SECRET=your_oidc_client_secret
CLAUDIO_OIDC_REDIRECT_URI=https://claudio.example.com/api/auth/oidc/authentik/callback

Config File

[auth.oidc_provider]
slug = "authentik"
display_name = "Authentik"
logo_url = "https://auth.example.com/static/dist/assets/icons/icon.png"
discovery_url = "https://auth.example.com/application/o/claudio/.well-known/openid-configuration"
client_id = "your_oidc_client_id"
client_secret = "your_oidc_client_secret"
redirect_uri = "https://claudio.example.com/api/auth/oidc/authentik/callback"

Fields

Field	Required	Description
`slug`	Yes	Stable provider identifier used in callback URLs
`display_name`	Yes	Button label shown in the login UI
`logo_url`	No	Image shown beside the provider button
`discovery_url`	Yes	Full OIDC discovery document URL (must end in `/.well-known/openid-configuration`)
`client_id`	Yes	OAuth client ID
`client_secret`	Yes	OAuth client secret
`redirect_uri`	Yes	Must match the provider-side callback exactly
`scope`	No	Defaults to `openid profile email`
`user_id_claim`	No	Defaults to `sub`
`username_claim`	No	Defaults to `preferred_username`
`name_claim`	No	Defaults to `name`
`email_claim`	No	Defaults to `email`

If your provider uses standard OIDC claim names, you can omit scope and the claim mapping fields.

Provider Examples

Authentik

CLAUDIO_OIDC_SLUG=authentik
CLAUDIO_OIDC_DISPLAY_NAME=Authentik
CLAUDIO_OIDC_DISCOVERY_URL=https://auth.example.com/application/o/claudio/.well-known/openid-configuration
CLAUDIO_OIDC_CLIENT_ID=your_client_id
CLAUDIO_OIDC_CLIENT_SECRET=your_client_secret
CLAUDIO_OIDC_REDIRECT_URI=https://claudio.example.com/api/auth/oidc/authentik/callback

Authelia

CLAUDIO_OIDC_SLUG=authelia
CLAUDIO_OIDC_DISPLAY_NAME=Authelia
CLAUDIO_OIDC_DISCOVERY_URL=https://auth.example.com/.well-known/openid-configuration
CLAUDIO_OIDC_CLIENT_ID=your_client_id
CLAUDIO_OIDC_CLIENT_SECRET=your_client_secret
CLAUDIO_OIDC_REDIRECT_URI=https://claudio.example.com/api/auth/oidc/authelia/callback

Pocket ID

CLAUDIO_OIDC_SLUG=pocketid
CLAUDIO_OIDC_DISPLAY_NAME="Pocket ID"
CLAUDIO_OIDC_DISCOVERY_URL=https://pocketid.example.com/.well-known/openid-configuration
CLAUDIO_OIDC_CLIENT_ID=your_client_id
CLAUDIO_OIDC_CLIENT_SECRET=your_client_secret
CLAUDIO_OIDC_REDIRECT_URI=https://claudio.example.com/api/auth/oidc/pocketid/callback