# OIDC client binding (coulomb.social)

Non-secret registration checklist for NetKingdom IAM Profile issuers.

| Field | Value / notes |
|-------|----------------|
| Application | coulomb.social |
| Profile | NetKingdom IAM Profile (PKCE required) |
| client_id | set per environment (`OIDC_CLIENT_ID`) |
| client_secret | OpenBao / local 0600 only — never Git |
| redirect_uri (dev) | `http://127.0.0.1:8008/auth/callback/` |
| redirect_uri (prod) | `https://coulomb.social/auth/callback/` (confirm at deploy) |
| scopes | `openid profile email` (+ profile claims as issuer provides) |
| grant | authorization_code + PKCE S256 |
| wildcard redirects | **forbidden** (KeyCape constraint) |

## Status

| Environment | Issuer mode | Registered |
|-------------|-------------|------------|
| local | dev claims (`OIDC_ENABLED=false`) | n/a |
| platform | KeyCape / local-identity / Keycloak | pending operator registration (T03) |

When registering, record the live client_id here (not the secret) and the
issuer base URL in deploy notes.