Rails (OmniAuth)

See the Applications overview for prerequisites, configuration endpoints, and available scopes.

OmniAuth OpenID Connect (opens in new tab) provides a standard OIDC strategy for Rails applications. Key configuration:

• Install omniauth-openid-connect (opens in new tab) and omniauth-rails_csrf_protection (opens in new tab) gems
• Enable PKCE in the OmniAuth provider configuration (pkce: true)
• CSRF protection is required for the OmniAuth request phase
• Callback URL: /auth/vouch/callback
• The hardware attestation claim (hardware_verified) is in the access token JWT — decode the payload to read it

Example

web/rails-omniauth (opens in new tab) — Complete working example with OmniAuth OIDC strategy, PKCE, and hardware claim extraction.