Endpoints reference
Where the canonical endpoint URLs come from
Derive the core endpoint URLs (authorize, token, UserInfo, JWKS) at runtime from the discovery document rather than hardcoding them, so your integration adapts if a path ever changes. Be aware that the discovery document also advertises endpoints that are not enabled for Partner use - token introspection, dynamic client registration, and the device endpoints - so the presence of an endpoint URL there does not mean the capability is available to you. Confirm with LuxID.
- Production: https://login.luxid.lu/.well-known/openid-configuration (opens in a new tab)
- UAT: https://login-uat.luxid.lu/.well-known/openid-configuration (opens in a new tab)
This page mirrors the discovery document for quick human reference. If a value here ever disagrees with the discovery document, the discovery document wins.
OIDC / OAuth 2.0 endpoints
| Discovery field | Production URL |
|---|---|
issuer | https://login.luxid.lu |
authorization_endpoint | https://login.luxid.lu/mga/sps/oauth/oauth20/authorize |
token_endpoint | https://login.luxid.lu/mga/sps/oauth/oauth20/token |
userinfo_endpoint | https://login.luxid.lu/mga/sps/oauth/oauth20/userinfo |
jwks_uri | https://login.luxid.lu/mga/sps/oauth/oauth20/jwks/OIDC-LUXID |
introspection_endpoint | https://login.luxid.lu/mga/sps/oauth/oauth20/introspect |
revocation_endpoint | https://login.luxid.lu/mga/sps/oauth/oauth20/revoke |
For UAT, replace the host login.luxid.lu with login-uat.luxid.lu throughout; the paths are identical. This means a single LUXID_BASE_URL environment variable can drive the whole configuration.
How to sign a user out
end_session_endpointLuxID does not expose an OIDC end_session_endpoint, and it is therefore not in the discovery document.
To let a user end their LuxID SSO session, redirect them to the user-driven logout URL (include your client_id so LuxID can name your application on the confirmation screen):
https://login.luxid.lu/auth/logout?client_id=<your_client_id>
See Session management and Revocation for the full sign-out model (revocation invalidates tokens but does not end the SSO session).
SAML 2.0 endpoints
| Purpose | Value |
|---|---|
| SSO (SP-initiated AuthnRequest destination) | https://login.luxid.lu/saml/sps/saml20idp-LUXID/saml20/login |
| IdP metadata (Production) | Download SAML metadata |
| IdP metadata (UAT) | Download SAML metadata |
The X.509 signing certificate is published inside the metadata XML - read it from there rather than hardcoding. LuxID does not support SAML Single Logout, so there is no SLO endpoint. See SAML 2.0.
Supporting surfaces
| Surface | URL |
|---|---|
| User account dashboard | https://account.luxid.lu/ (opens in a new tab) |
| Partner API base URL | Provided with your Partner API credentials - see Partner API - Getting Started |
Rate limits
All endpoints are rate-limited. The exact values are deliberately not published - they can be adjusted in response to abuse without notice - so do not hardcode assumptions about them. Design for 429/throttling responses with exponential backoff and respect any Retry-After header; the full guidance, including timeout and retry patterns, is in Calling LuxID reliably.
Related pages
- OpenID Connect - full protocol reference and parameter detail.
- SAML 2.0 - SAML SSO, metadata exchange and assertion handling.
- Sandbox environment - UAT host and environment differences.