Docs/Add Hardware-Backed Sign-In to Your Application/ Rails (OmniAuth)
View as .md

Rails (OmniAuth)

See the Applications overview for prerequisites, configuration endpoints, and available scopes.

OmniAuth OpenID Connect provides a standard OIDC strategy for Rails applications. Key configuration:

  • Install omniauth-openid-connect and omniauth-rails_csrf_protection gems
  • Enable PKCE in the OmniAuth provider configuration (pkce: true)
  • CSRF protection is required for the OmniAuth request phase
  • Callback URL: /auth/vouch/callback
  • The hardware attestation claim (hardware_verified) is in the access token JWT — decode the payload to read it

Example

web/rails-omniauth — Complete working example with OmniAuth OIDC strategy, PKCE, and hardware claim extraction.