How to use OpenID with Authelia?

[wsw70]

I am trying to connect Karakeep to Authelia using OpenID. Authelia has documentation about that, mentionning that Karakeep is not handling OpenID correctly. This is my Authelia configuration (from the documentation, I merged the main part and the workaround - what is below is the part relevant to Karakeep):

identity_providers:
  oidc:
    claims_policies:
      karakeep: # https://www.authelia.com/integration/openid-connect/clients/karakeep/
        id_token: ['email']
    clients:
      - client_id: 'karakeep'
        client_name: 'Karakeep'
        client_secret: '$pbkdf2-XXX'
        public: false
        authorization_policy: 'two_factor'
        require_pkce: false
        pkce_challenge_method: ''
        redirect_uris:
          - 'https://karakeep.YYY.eu/api/auth/callback/custom'
        scopes:
          - 'openid'
          - 'profile'
          - 'email'
        response_types:
          - 'code'
        grant_types:
          - 'authorization_code'
        access_token_signed_response_alg: 'none'
        userinfo_signed_response_alg: 'none'
        token_endpoint_auth_method: 'client_secret_basic'
        claims_policy: 'karakeep'

I can go though the whole scenario: incognito mode → https://karakeep.YYY.eu → signin page → choose Authelai as the login provider → Authelia login → Authelia consent → redirection to Karakeep

And this is where I get

On the backend, I see

web-1          | 2026-01-12T10:38:58.022Z info: <-- GET /api/health
web-1          | 2026-01-12T10:38:58.028Z info: --> GET /api/health 200 6ms
web-1          | (node:70) [DEP0169] DeprecationWarning: `url.parse()` behavior is not standardized and prone to errors that have security implications. Use the WHATWG URL API instead. CVEs are not issued for `url.parse()` vulnerabilities.
web-1          | (Use `node --trace-deprecation ...` to show where the warning was created)
web-1          | [next-auth][error][OAUTH_CALLBACK_ERROR] 
web-1          | https://next-auth.js.org/errors#oauth_callback_error invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).) {
web-1          |   error: Error [OAuthCallbackError]: invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)
web-1          |       at e.exports (.next/server/chunks/2992.js:48:89770)
web-1          |       at X.grant (.next/server/chunks/2992.js:36:15031)
web-1          |       at async X.callback (.next/server/chunks/2992.js:36:2813)
web-1          |       at async c (.next/server/chunks/2992.js:80:219233)
web-1          |       at async Object.l (.next/server/chunks/2992.js:80:264160)
web-1          |       at async g (.next/server/chunks/2992.js:80:50417)
web-1          |       at async a (.next/server/chunks/2992.js:80:209061)
web-1          |       at async e.length.t (.next/server/chunks/2992.js:80:210504) {
web-1          |     code: undefined
web-1          |   },
web-1          |   providerId: 'custom',
web-1          |   message: 'invalid_client (Client authentication failed (e.g., unknown client, no client authentication included, or unsupported authentication method).)'
web-1          | }
web-1          | 2026-01-12T10:39:28.149Z info: <-- GET /api/health
web-1          | 2026-01-12T10:39:28.150Z info: --> GET /api/health 200 1ms

has anyone successfully configured Karakeep with Authelia?

[Eragos]

Hey!

This authelia config works for me since years. Btw, I never had those mentioned claim issues, maybe it was temporary.

authelia config

      - client_id: 'karakeep'
        client_name: 'karakeep'
        client_secret: '$argon2id$v=[...]
        claims_policy: 'default'
        public: false
        token_endpoint_auth_method: 'client_secret_basic'
        authorization_policy: 'two_factor'
        consent_mode: 'implicit'
        redirect_uris:
          - 'https://karakeep.domain/api/auth/callback/custom'
        audience:
          - 'https://karakeep.domain'
        requested_audience_mode: explicit
        scopes:
          - 'openid'
          - 'email'
          - 'profile'

karakeep .env part

OAUTH_WELLKNOWN_URL=https://auth.domain/.well-known/openid-configuration
OAUTH_CLIENT_SECRET=<hidden>
OAUTH_CLIENT_ID=karakeep
OAUTH_SCOPE=openid email profile
OAUTH_PROVIDER_NAME=Authelia
OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=true

Seems authelia doesn't know/recognize your config:
unknown client, no client authentication included, or unsupported authentication method

Best, Michael

[auspex]

Personally, I've had Authelia/Karakeep running together for around 6 months, but last week it started to just loop on the "log in with Authelia" button, and i haven't had time to run it down. I expect it's something I broke, but it means I'm not in a position to tell you what will work

[auspex]

Btw, imo Authelia's warning about Karakeep's implementation is overly dramatic. First, it's not something directly in Karakeep's control: it's a library used by many applications, and they all have the same warning in the Authelia dox, and secondly, if you use the "escape hatch" it's compliant