Ory Hydra Configuration
Getting the issuerUri
and clientId
issuerUri
and clientId
oidc-spa
requires two parameters to connect to your Ory Hydra instance: issuerUri
and clientId
.
issuerUri
issuerUri
In Ory Hydra, the OIDC issuer URI is the public URL where Hydra’s OpenID Connect configuration is available. It typically follows this format:
https://<HYDRA_DOMAIN><HYDRA_RELATIVE_PATH>
<HYDRA_DOMAIN>: The domain where your Ory Hydra instance is hosted (e.g., hydra.my-company.com).
<HYDRA_RELATIVE_PATH>: The subpath (if any) under which Hydra is accessible. In most deployments, this is an empty string (
""
), but if you’re using a reverse proxy or a custom path, it might be something like"/oidc"
. Hydra exposes its OpenID Connect configuration at:https://<HYDRA_DOMAIN><HYDRA_RELATIVE_PATH>/.well-known/openid-configuration
clientId
clientId
Unlike Keycloak, Ory Hydra is a headless OAuth2 provider and does not offer a built-in admin console for client registration. You must register your SPA as a client via the Hydra CLI or its REST API.
For example, using the Hydra CLI you can run:
Parameters explained:
<APP_DOMAIN>: Your application’s domain, e.g., my-company.com or app.my-company.com. 🔹 To avoid issues with third-party cookie deprecation, ensure that your app’s domain and Hydra’s domain share the same root domain when necessary.
<BASE_URL>: The base URL of your SPA, for example, "/" or "/dashboard/".
<DEV_PORT>: The development port (e.g., 5173 for Vite).
Once registered, the client’s unique identifier (the clientId
) will be used in your oidc-spa
configuration.
Token Lifespan & Session Considerations
Infer from Keycloak documentation:
Last updated
Was this helpful?