Can other software discover how my site handles sign-in?
If your service is an identity provider, the system that signs people in and vouches for who they are, OpenID Connect discovery is the file that describes it to other software: where sign-in happens, where tokens come from and which keys sign them. We check whether your domain publishes one.
What it actually is
It is the public notice an identity provider posts so others can trust its passes: here is my name, here is where you send people to sign in, here are the keys I sign with, check them yourself. OpenID Connect is the layer on top of OAuth that adds who the user is to what they may do, and this file is how it introduces itself.
Why it matters
Any app or agent that offers "sign in with your account" needs these details, and reading them from the source is the difference between an integration that keeps working and one that breaks at the next key rotation. It is also how software checks that a token really came from you rather than from someone pretending to be you.
What good looks like
A discovery document on the domain that issues your sign-in tokens, whose issuer matches that domain exactly, with endpoints that answer and a link to signing keys that are current.
Being honest about it
This is an Advanced check, so it never fails a page and stays out of your headline score. Only identity providers publish this file. Most companies sign their users in through a provider such as Google, Microsoft or a specialist service, and that provider publishes it on its own domain, so a warning on yours is the expected result.
Where most sites go wrong
The common confusion is between the company's website and its sign-in domain: the document exists, but on a separate identity subdomain, not on the domain that was scanned. The other is an issuer value that does not match the address it was served from, which strict software treats as a reason not to trust it.
Not sure where yours stands?
A free scan checks this and everything else in about 20 seconds — no signup. Or if it's already flagged and you'd rather it were simply handled, we do that too.
Flagged for this one? We handle it. No pitch, just a plain-English chat.
Book a call