// the find
openiddict/openiddict-core
Flexible and versatile OAuth 2.0/OpenID Connect stack for .NET
OpenIddict is a framework for building OAuth 2.0/OpenID Connect servers, clients, and token validators in .NET. It targets teams who want full control over the auth flow — you write the authorization controller, it handles the protocol plumbing. Not a drop-in identity server, but a solid foundation for one.
Genuinely broad protocol coverage: authorization code, device flow, token exchange (RFC 8693), and PKCE are all first-class, not bolted on. The storage abstraction is clean — EF Core, EF6, and MongoDB ship out of the box, and the interface is narrow enough that a custom store (DynamoDB, CouchDB) is realistic work rather than a rewrite. The client component working on mobile platforms (Android, iOS, macOS) via the same NuGet package is a real differentiator over alternatives that are server-only. Active maintenance with 7.0 shipping July 2025 and a clear versioning story tied to both ABP Framework and sponsorship tiers.
The support policy is a dealbreaker for many: GitHub issues from non-sponsors are auto-closed. If you hit a bug and can't afford a sponsorship tier, your options are Gitter or silence. No official certification submission — the README explains why, but the practical result is that you have to run the conformance tests yourself and own the results, which most teams won't do. It's explicitly not turnkey: you must implement the authorization controller, consent UI, and user management yourself, which is fine architecturally but means the onboarding cliff is steep compared to something like Keycloak or Duende IdentityServer. The eng/common infrastructure (hundreds of files, cross-compilation toolchains for ARM, RISC-V) is clearly inherited from the .NET Arcade SDK and adds considerable noise to the repo for anyone trying to understand the actual library code.