Provider
Zitadel
Zitadel provider documentation
Feature/OIDC support
✅ PKCE
✅ Nonce
✅ State
❌ Access Token validation
✅ ID Token validation
Introduction
For Zitadel you have to provide at least the baseUrl, clientId and redirectUri properties. The baseUrl is used to dynamically create the authorizationUrl, tokenUrl, logoutUrl and userInfoUrl.
The preset uses PKCE with authenticationScheme: 'none', so public clients omit clientSecret. Confidential clients can use authenticationScheme: 'header' or 'body' and must provide a non-empty client secret.
Provider specific parameters
This providers doesn't have specific parameters.
Example Configuration
Never store sensitive values like client secrets in your Nuxt config. Inject confidential-client secrets through environment variables.
nuxt.config.ts
zitadel: {
clientId: '',
redirectUri: 'http://localhost:3000/auth/zitadel/callback', // Replace with your domain
baseUrl: '', // For example https://PROJECT.REGION.zitadel.cloud
audience: '', // Specify for id token validation, normally same as clientId
logoutRedirectUri: 'https://google.com', // Needs to be registered in Zitadel portal
authenticationScheme: 'none',
},
Environment variables
Dotenv files are only for (local) development. Use a proper configuration management or injection system in production.
.env
NUXT_OIDC_PROVIDERS_ZITADEL_CLIENT_ID=123456789012345678
NUXT_OIDC_PROVIDERS_ZITADEL_BASE_URL=https://PROJECT.us1.zitadel.cloud/