DOCSEARCHbyAlgolia
Submit Docs

ThunderID Documentation

website·Indexed 32 days ago

https://thunderid.dev

An authentication and identity platform providing SDKs for React, Next.js, Express, Vue, Nuxt, Node.js, iOS, Android, and Flutter. ThunderID features support for AI agents via LangChain, Model Context Protocol (MCP) servers, and customizable identity patterns for B2C consumer access, including sign-in flows, account recovery, and internal staff onboarding.

Tokens
153.7K
Snippets
485
Records
964
Agent score
66%

What's inside ThunderID

  1. Overview of DPoP Sender-Constrained Tokens in ThunderID

    Demonstrating Proof-of-Possession (DPoP) as per RFC 9449 binds an access token to a public key held by the client. ThunderID embeds a thumbprint of the client's key in the token's cnf.jkt claim. To use the token, the client must provide a fresh DPoP proof JWT signed with the matching private key for every request. This ensures that a stolen token is useless without the corresponding private key. DPoP is an application-layer alternative to mutual TLS (mTLS).

  2. Overview of Single Sign-On (SSO) for Flows

    Single Sign-On (SSO) in ThunderID allows users to authenticate once and reuse that authentication across different applications that share the same authentication flow. Flow SSO is flow-centric (sessions belong to one specific flow), browser-scoped (relying on per-flow cookies), and checkpoint-based (skipping specific sets of authentication steps).

  3. Overview of Backchannel Authentication (CIBA) in ThunderID

    Client-Initiated Backchannel Authentication (CIBA) allows a client application to trigger user authentication on a separate device (authentication device) from the one initiating the request (consumption device), removing the need for browser redirects.

    ThunderID implements CIBA with the following constraints:

    • Mode: Only 'poll mode' is supported (push mode is not implemented).
    • Client Type: Only confidential clients are supported.
    • User Hints: Exactly one of login_hint or id_token_hint must be provided. login_hint_token is not supported.
    • Scope: Must include the openid scope.
    • One-time use: The auth_req_id is consumed upon the first successful token exchange; subsequent attempts return invalid_grant.

  4. Overview of ThunderID MCP Server

    ThunderID provides a Model Context Protocol (MCP) server that allows AI assistants and MCP clients to manage applications, authentication flows, users, and themes. The server is available at the /mcp endpoint of the ThunderID instance (default: https://localhost:8090/mcp). It follows the MCP Authorization Specification, using OAuth authorization code + PKCE flow for authentication. Access requires the system scope and an administrator account.

  5. Overview of Workload Identity Federation in ThunderID

    Workload Identity Federation allows a confidential client (such as an AI agent or a backend application) to access an external platform without storing long-lived static API keys. Instead of a static key, the workload uses a signed token from ThunderID to obtain a short-lived credential from the target platform. This improves security by ensuring credentials expire and are traceable to a specific ThunderID identity.

  6. Overview of ThunderID Import and Export

    Import and export allow developers to move ThunderID resources between environments (e.g., development to staging or production) without manual recreation in the Console or via REST APIs. This system enables identity configuration to be kept in version control, the setup of new instances with required resources, and the reuse of sample application configurations across multiple environments.

  7. Overview of MCP Authorization modes in Wayfinder

    The Wayfinder sample application demonstrates two distinct modes for authorizing Model Context Protocol (MCP) tools:

    1. Scope-based MCP authorization: Validates permissions based on the scopes already present within the incoming access token.
    2. AuthZEN-based MCP authorization: Validates the incoming token and then queries the ThunderID Policy Decision Point (PDP) for a real-time allow/deny decision before the protected tool handler is invoked.

  8. Overview of ThunderID Observability

    ThunderID emits structured observability events for key identity operations, including token issuance, authentication flow execution, and authorization decisions. These are distinct from standard application logs (INFO/WARN/ERROR). Events can be routed to different backends depending on the environment: Console (local/containers), File (persistent local storage), or OpenTelemetry (distributed tracing). All backends are disabled by default.

  9. Overview of ThunderID Magic Link Authentication

    Magic Links provide a passwordless authentication experience where ThunderID generates a secure, one-time-use token sent via email or SMS. When the user clicks the link, their identity is verified, and they are logged in or registered. This can be implemented via a Redirect-Based approach (using ThunderID's hosted 'Gate' pages) or an App-Native approach (using a custom UI and the Flow Execution API).

  10. Overview of OpenAI Workload Identity Federation with ThunderID

    ThunderID integrates with OpenAI's workload identity federation to allow agents to access OpenAI APIs without static API keys. The process involves the agent obtaining an Agent Token from ThunderID, which is then exchanged at OpenAI for a short-lived OpenAI access token. This ensures that disabling an agent in ThunderID immediately terminates its ability to obtain new OpenAI access tokens.

  11. Overview of Verifiable Credentials in ThunderID

    ThunderID implements the OpenID for Verifiable Credentials (OpenID4VC) family of specifications. This allows developers to issue digital identity credentials to wallets and accept cryptographic proof of those credentials at relying parties. This system complements OAuth 2.1 and OpenID Connect by replacing traditional username/password prompts with requests for cryptographic proof from government- or institution-issued credentials.

  12. Overview of OpenID4VCI issuance in ThunderID

    ThunderID implements OpenID for Verifiable Credential Issuance (OpenID4VCI) to allow wallets to request signed SD-JWT Verifiable Credentials (VCs). The process uses the OAuth 2.1 authorization code flow where the wallet acts as the OAuth client. The issued SD-JWT VC is bound to the wallet's key via the cnf claim (containing the public key as a JWK), enabling selective disclosure of attributes.