The M7 provider profile is public

By The Grim Scalper · Tags: m7 , identity , launch , documentation , apis , operators , changelog , id.m7

M7 now publishes an OAuth 2.0 and OpenID Connect provider profile. Live discovery matches it, including RFC 8705 mutual TLS.

This is the integration contract an external client can rely on. The profile version is M7-OIDC-1.0-RC1. It is a release candidate. It is not OpenID certification, and it is not GA.

The opening post said you could start, and that this was not mTLS. That second sentence is done.

A brass contract plate mounted on dark machinery.

Where to read it

If a feature is absent from live discovery, treat it as unavailable even if a document describes staged work.

What is advertised now

The stock path is unchanged: authorization code with PKCE S256, PAR (201), device authorization, client_credentials, rotating refresh. Public clients use none. Confidential clients use Basic, POST, HMAC JWT, or private-key JWT.

Sender constraint is RFC 9449 DPoP with ES256. UserInfo is JSON or a signed JWT. Dynamic registration still does not grant itself a resource audience.

Mutual TLS is now on that list. Discovery advertises both RFC 8705 methods, tls_client_certificate_bound_access_tokens, and dedicated aliases on mtls-sso.user.m7.org for token, PAR, device authorization, introspection, revocation, and UserInfo. The canonical issuer remains https://sso.user.m7.org. Authorization, discovery, registration, and JWKS stay on that origin.

A certificate-bound token records the leaf thumbprint as cnf."x5t#S256". Refresh and resource use must present that certificate over mutual TLS. It does not downgrade to Bearer. If the token also carries DPoP, both constraints apply.

Ordinary HTTPS clients do not have to touch this. Sign in with M7 on a PHP site still uses the canonical endpoints. mTLS is for clients that present a certificate.

What this is not

This is not GA. It is not OpenID certified. The official conformance suite has not run. It is not Packagist. Access tokens still use the token-class issuer id.m7.org; do not substitute the discovery issuer when validating them.

People, machines, and tenants remain different principals. Development access remains. The PHP SDK remains the first language pack.

Start at the profile if you are integrating. Start at the website install if you want the button on a page.