Duende.Labs.IdentityModel 2026.806.21

IdentityModel for .NET

Modern OpenID Connect and OAuth 2.0 client library for .NET 10+.

Installation

dotnet add package Duende.Labs.IdentityModel

Note This package is experimental/preview. For production scenarios, consider Duende.IdentityModel.

Features

This package provides request/response models and HttpClient extensions for:

• Discovery document retrieval
• JSON Web Keys (JWK/JWKS)
• Token endpoint requests
• Token introspection and revocation
• UserInfo endpoint access
• Device authorization flow
• Pushed Authorization Requests (PAR)
• Dynamic client registration
• Rich Authorization Requests (RAR)

Quick start

using Duende.Labs.IdentityModel.Discovery;

var client = new HttpClient();
var result = await client.GetDiscoveryDocumentAsync(cancellationToken);

if (result.IsSuccess)
{
    Console.WriteLine(result.Response.TokenEndpoint);
}
else
{
    Console.WriteLine(result.Error.Message);
}

Endpoint addresses

Every request record carries a required Uri Address. It can be absolute, or relative to the HttpClient.BaseAddress, which composes naturally with a named client:

services.AddHttpClient("authority", c => c.BaseAddress = new Uri("https://demo.duendesoftware.com"));

// elsewhere
var request = new ClientCredentialsTokenRequest
{
    Address = new Uri("/connect/token", UriKind.Relative),
    ClientCredential = new ClientCredential("m2m", "secret")
};

A relative address without a BaseAddress fails with ProtocolErrorType.InvalidRequest. The resolved absolute address must be https, or http on loopback; anything else fails with ProtocolErrorType.PolicyViolation.

Behaviour change Revocation, UserInfo, device authorization, pushed authorization, dynamic client registration and backchannel authentication previously performed no transport-security validation. They now share the same rule as the token and introspection endpoints, so plaintext http:// requests to a non-loopback host are rejected.

Dependency injection

Duende.Labs.IdentityModel stays dependency-free. If you want configuration-driven registration and endpoint resolution, add the companion package:

dotnet add package Duende.Labs.IdentityModel.DependencyInjection

services.AddIdentityModelClient(options =>
{
    options.Authority = new Uri("https://demo.duendesoftware.com");
    options.ClientCredential = new ClientCredential("m2m", "secret");
    options.Scope = "api";
});

// ...
var result = await client.RequestClientCredentialsTokenAsync(ct);

Endpoints come from the authority's discovery document, which is fetched once per client name and memoized. See the companion package readme.

Samples

Runnable samples are available in the repository under libs/identity-model/dotnet/samples/, for example:

dotnet run --project samples/Discovery
dotnet run --project samples/DependencyInjection

Learn more

• Production library: Duende.IdentityModel

License

IdentityModel is open source under the Apache 2.0 license.