OpenID Connect Discovery

Use the OpenID Provider configuration to find TBC Bank's endpoint URLs and the capabilities available in each environment. Retrieve the configuration for the same environment you use for authentication.

Discovery Endpoint

Send a GET request to the discovery endpoint.

Sandbox: https://test-api.tbcbank.ge/.well-known/openid-configuration

Production: https://api.tbcbank.ge/.well-known/openid-configuration

Configuration Response

The endpoint returns a JSON document containing TBC Bank's OpenID Provider metadata, including endpoint URLs, supported authentication capabilities, and jwks_uri, which identifies the JSON Web Key Set used to verify signed tokens.

Use the metadata for the matching environment rather than hardcoding endpoint values. Validate the returned issuer against the issuer expected for that environment. Use jwks_uri from the same configuration to retrieve public keys when validating token or UserInfo response signatures.

For the Authorization Code Flow and Client-Initiated Backchannel Authentication Flow, follow their endpoint guidance.

Configuration Parameters

Parameter	Description
`issuer`	Identifier of the OpenID Provider. Validate it against the issuer expected for the environment.
`scopes_supported`	OAuth 2.0 scopes supported by the provider.
`response_types_supported`	OAuth response types supported by the provider.
`grant_types_supported`	OAuth grant types supported by the provider.
`authorization_endpoint`	URL used to start the authorization code flow.
`backchannel_authentication_endpoint`	URL used to start a CIBA request.
`jwks_uri`	URL of the JSON Web Key Set (JWKS) containing public keys used to verify signatures on tokens and signed UserInfo responses.
`mtls_endpoint_aliases`	Object containing alternative mTLS endpoint URLs. In TBC Bank's discovery response, token, UserInfo, and registration endpoint URLs are provided as aliases in this object, not as top-level endpoint fields.
`mtls_endpoint_aliases.token_endpoint`	mTLS URL used to exchange an authorization grant for tokens.
`mtls_endpoint_aliases.userinfo_endpoint`	mTLS URL used to retrieve information about an authenticated user.
`mtls_endpoint_aliases.registration_endpoint`	mTLS URL used for client registration, if provided and applicable to your integration.
`backchannel_authentication_request_signing_alg_values_supported`	Signing algorithms supported for signed backchannel authentication requests.
`backchannel_token_delivery_modes_supported`	Token delivery modes supported for CIBA. Polling is currently the supported mode for TBC ID.
`backchannel_user_code_parameter_supported`	Indicates whether the provider supports the CIBA `user_code` parameter in backchannel authentication requests. It does not by itself indicate that the code is an SMS OTP.
`token_endpoint_auth_methods_supported`	Client authentication methods supported at the token endpoint.
`acr_values_supported`	Authentication Context Class Reference (ACR) values supported by the provider.
`id_token_signing_alg_values_supported`	Algorithms supported for signing ID tokens.
`userinfo_signing_alg_values_supported`	Algorithms supported for signing UserInfo responses.
`subject_types_supported`	Subject identifier types supported by the provider.
`verified_claims_supported`	Indicates whether the provider supports returning verified claims.
`trust_frameworks_supported`	Trust frameworks supported for verified claims.
`evidence_supported`	Evidence types supported for identity verification.
`claims_in_verified_claims_supported`	Claims that may be returned as verified claims.
`id_documents_supported`	Identity document types supported for verification.
`id_documents_verification_methods_supported`	Verification methods supported for identity documents.
`claims_parameter_supported`	Indicates whether the `claims` request parameter is supported.
`ui_locales_supported`	Languages supported for the authorization user interface.
`claims_locales_supported`	Languages supported for localized claim values.
`claims_ui_locales_supported`	Languages supported for the user interface shown during claims processing.

Example Request and Response

The following example retrieves the sandbox OpenID Provider configuration.

⚠️
Metadata and endpoint URLs can vary by environment
Retrieve the configuration for the environment you are using rather than hardcoding these values.

Request / Response Example

https://test-api.tbcbank.ge/.well-known/openid-configuration

{
  "issuer": "https://test-api.tbcbank.ge",
  "token_endpoint_auth_methods_supported": [
    "tls_client_auth"
  ],
  "authorization_endpoint": "https://test-api.tbcbank.ge/psd2/openbanking/oauth/authorize",
  "mtls_endpoint_aliases": {
    "token_endpoint": "https://test-openbanking.tbcbank.ge/openbanking/oauth/token",
    "registration_endpoint": "https://test-openbanking.tbcbank.ge/openbanking/oauth/register",
    "userinfo_endpoint": "https://test-openbanking.tbcbank.ge/userinfo"
  },
  "scopes_supported": [
    "openid",
    "profile"
  ],
  "response_types_supported": [
    "code"
  ],
  "grant_types_supported": [
    "authorization_code",
    "ciba"
  ],
  "backchannel_authentication_endpoint": "https://test-openbanking.tbcbank.ge/psd2/openbanking/oauth/bc-authorization",
  "backchannel_authentication_request_signing_alg_values_supported": [
    "RS256"
  ],
  "backchannel_token_delivery_modes_supported": [
    "poll"
  ],
  "backchannel_user_code_parameter_supported": true,
  "ui_locales_supported": [
    "en",
    "ka"
  ],
  "claims_locales_supported": [
    "en",
    "ka"
  ],
  "acr_values_supported": [
    "https://openfinance.ge/ns/assurance/basic",
    "https://openfinance.ge/ns/assurance/sca",
    "https://openfinance.ge/ns/assurance/tmp/otp-challenge"
  ],
  "trust_frameworks_supported": [
    "ge_aml"
  ],
  "verified_claims_supported": true,
  "id_token_signing_alg_values_supported": [
    "RS256"
  ],
  "userinfo_signing_alg_values_supported": [
    "RS256"
  ],
  "claims_ui_locales_supported": [
    "en",
    "ka"
  ],
  "evidence_supported": [
    "id_document"
  ],
  "claims_in_verified_claims_supported": [
    "given_name",
    "family_name",
    "personal_id_number",
    "birthdate",
    "place_of_birth",
    "nationalities",
    "msisdn",
    "email"
  ],
  "id_documents_supported": [
    "idcard",
    "passport",
    "ge_residence_temporary",
    "ge_residence_permanent"
  ],
  "id_documents_verification_methods_supported": [
    "pipp",
    "eid"
  ],
  "claims_parameter_supported": true,
  "subject_types_supported": [
    "public"
  ],
  "jwks_uri": "https://test-api.tbcbank.ge/.well-known/keys"
}