Agent identity
Companies learn who this agent is from its client metadata document. Its URL is the client_id, and its key signs every assertion. §4.1
Client metadata
- client_id
- …
- NameShown on consent pages
- Key setjwks_uri
- Redirect URIFor Direct Sign-In
- Client authentication
Signing key
Signs client assertions, Session assertions, and browser assertions. It never leaves the server.
- Key ID
- …
- Algorithm
- Source
- DPoP keysSeparate, never published
- One per User per Company, created in your browser.