# Overview (/docs/configuration/authentication/OAuth2-OIDC)

This section will cover how to configure OAuth2 and OpenID Connect with LibreChat

<div style={{ padding: "20px", display: "flex", justifyContent: "center", alignItems: "center", flexDirection: "column" }}>
  <div className="image-light-theme">
    <img src="https://github.com/danny-avila/LibreChat/assets/32828263/786fa525-73c4-4640-b4cf-91925ad8802e" style={{ width: "75%", height: "75%" }} alt="Image for Light Theme" />
  </div>

  <div className="image-dark-theme">
    <img src="https://github.com/danny-avila/LibreChat/assets/32828263/dddc34c6-9602-4177-89e8-4c0db01b0eac" style={{ width: "75%", height: "75%" }} alt="Image for Dark Theme" />
  </div>
</div>

## OAuth2

- [Apple](/docs/configuration/authentication/OAuth2-OIDC/apple)
- [Discord](/docs/configuration/authentication/OAuth2-OIDC/discord)
- [Facebook](/docs/configuration/authentication/OAuth2-OIDC/facebook)
- [GitHub](/docs/configuration/authentication/OAuth2-OIDC/github)
- [Google](/docs/configuration/authentication/OAuth2-OIDC/google)

## OpenID Connect

- [Auth0](/docs/configuration/authentication/OAuth2-OIDC/auth0)
- [AWS Cognito](/docs/configuration/authentication/OAuth2-OIDC/aws)
- [Azure Entra/AD](/docs/configuration/authentication/OAuth2-OIDC/azure)
- [Keycloak](/docs/configuration/authentication/OAuth2-OIDC/keycloak)
- [Re-use OpenID Tokens for Login Session](/docs/configuration/authentication/OAuth2-OIDC/token-reuse)

## Troubleshooting OpenID Connect

If you encounter issues with OpenID Connect authentication:

1. **Enable Header Debug Logging**: Set `DEBUG_OPENID_REQUESTS=true` in your environment variables to log request headers in addition to URLs (with sensitive data masked). Note: Request URLs are always logged at debug level
2. **Check Redirect URIs**: Ensure your callback URL matches exactly between your provider and LibreChat configuration
3. **Verify Scopes**: Make sure all required scopes are properly configured
4. **Review Provider Logs**: Check your identity provider's logs for authentication errors
5. **Validate Tokens**: Ensure your provider is issuing valid tokens with the expected claims
6. **Ensure _nonce_ is generated**: Some identity providers generate `nonce` url parameter if it's missing in the request. Set `OPENID_GENERATE_NONCE=true` to force the openid-client to generate it.