Required controls
- Authorization Code + PKCE with S256.
- Fresh state and code_verifier values.
- Exact redirect URI matching.
- Issuer, audience, expiry, and signature validation for ID tokens.
- Secure storage for tokens and client secrets.
Access tokens last one hour. Refresh tokens rotate and expire within 30 days; a reused refresh token revokes its token family. Keep refresh tokens server-side and never place credentials in URLs or browser logs.
Lucion does not claim third-party OAuth or OIDC certification on this page. Use the authoritative protocol references linked in the resources section.