> ## Documentation Index
> Fetch the complete documentation index at: https://docs.strait.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# OIDC Authentication

> Optional OpenID Connect bearer-token validation for user API access.

Strait can validate non-`strait_` bearer tokens using OIDC when enabled.

## When to use OIDC

Use OIDC when user requests should be authenticated directly with tokens from your IdP, while service-to-service traffic can still use `X-Internal-Secret`.

## Behavior

* Bearer token starts with `strait_` → API key auth path
* Other bearer token → OIDC verifier path (if configured)
* Internal secret header/bearer → internal secret auth path

## Configuration

Enable OIDC verifier settings in server config (issuer/audience/public-key related options).

## Context Mapping

On successful verification, Strait maps claims into:

* actor identity context (user)
* project context (when provided by claim/header mapping)

Authorization still goes through `requirePermission()` and RBAC policies.

## Rollout Tip

Run OIDC and internal-secret user identity in parallel during migration, then phase out internal headers for user traffic when your app is fully token-based.

See [Authentication & Authorization](/guides/authentication).