A public client ("none") has no secret, must use PKCE with S256 on /authorize,
cannot use the client_credentials grant, and always gets refresh token rotation.
Extra audiences added to the ID Token aud alongside the client_id.
When more than one distinct audience results, aud becomes an array and an azp claim is emitted.
When set, /authorize only accepts a redirect_uri that matches one of these exactly
(RFC 6749 §3.1.2.3, OAuth 2.1 §4.1.1). Leave empty to accept any syntactically valid URI (dev default).
When set, a requested scope outside this list is invalid_scope
at /authorize and /token (RFC 6749 §4.1.2.1/§5.2). Leave empty to
allow any scope in the global vocabulary (oauth.scopes_supported, dev default).
RFC 8707 (#187). When set, a resource requested at
/authorize or /token outside this list is
invalid_target. Leave empty to allow any valid resource
(an absolute URI without a fragment). The access token
aud is bound to the requested resource.
Login Page Branding (Optional)
Color for the card header band
Color for the card footer band
Horizontal places the client info and the login form side by side; it collapses
back to a single column on narrow screens.
Logo: To add a client logo to the login page, place an image file at
/usr/local/lib/python3.12/site-packages/nanoidp/static/logos/smegui.{svg,png,jpg,webp}
on the server - no configuration needed.