diff --git a/README.md b/README.md
index 5cd9be1c96..27ee4bddcc 100644
--- a/README.md
+++ b/README.md
@@ -35,6 +35,7 @@ so that the barrier to entry here is low.
 - Access Lists and basic HTTP Authentication for your hosts
 - Advanced Nginx configuration available for super users
 - User management, permissions, and audit log
+- OpenID Connect (OIDC) single sign-on
 
 ::: warning
 `armv7` is no longer supported in version 2.14+. This is due to Nodejs dropping support for armhf. Please
diff --git a/backend/internal/oidc.js b/backend/internal/oidc.js
new file mode 100644
index 0000000000..d6a616be2c
--- /dev/null
+++ b/backend/internal/oidc.js
@@ -0,0 +1,163 @@
+import crypto from "node:crypto";
+import db from "../db.js";
+import { getPrivateKey } from "../lib/config.js";
+import errs from "../lib/error.js";
+import { discover, identityKey, random, seal, unseal, validateConfig } from "../lib/oidc.js";
+import authModel from "../models/auth.js";
+import TokenModel from "../models/token.js";
+import userModel from "../models/user.js";
+import internalToken from "./token.js";
+
+const authStamp = (auth) =>
+	crypto
+		.createHash("sha256")
+		.update(
+			JSON.stringify([
+				auth?.secret,
+				auth?.meta?.password_changed_at,
+				auth?.meta?.totp_enabled,
+				auth?.meta?.totp_secret,
+				auth?.meta?.totp_enabled_at,
+			]),
+		)
+		.digest("hex");
+
+const defaults = {
+	enabled: false,
+	auto_login: false,
+	issuer: "",
+	public_url: "",
+	client_id: "",
+	client_secret: "",
+	scopes: "openid",
+	token_auth_method: "auto",
+};
+
+export async function readConfig() {
+	const row = await db()("oidc_config").where({ id: 1 }).first();
+	if (!row) return { config: { ...defaults }, revision: "initial" };
+	const config = { ...defaults, ...JSON.parse(row.config) };
+	config.client_secret = config.client_secret ? unseal(config.client_secret, getPrivateKey()) : "";
+	return { config, revision: row.revision };
+}
+export function publicConfig({ config, revision }) {
+	const { client_secret, ...safe } = config;
+	return {
+		...safe,
+		revision,
+		client_secret_configured: !!client_secret,
+		callback_url: config.public_url ? new URL("/api/oidc/callback", config.public_url).href : "",
+	};
+}
+export async function saveConfig(access, input) {
+	await access.can("settings:update", "oidc");
+	const previous = await readConfig();
+	if (input.revision !== previous.revision) throw new errs.ValidationError("OIDC settings changed; reload and retry");
+	const config = { ...previous.config };
+	for (const key of ["issuer", "client_id", "public_url", "scopes"]) {
+		if (typeof input[key] !== "string" || input[key].length > 2048)
+			throw new errs.ValidationError("Invalid OIDC field");
+		config[key] = input[key].trim();
+	}
+	config.scopes = config.scopes.split(/\s+/).filter(Boolean).join(" ");
+	if (input.token_auth_method !== undefined) config.token_auth_method = input.token_auth_method;
+	for (const key of ["enabled", "auto_login"]) {
+		if (typeof input[key] !== "boolean") throw new errs.ValidationError("Invalid OIDC switch");
+		config[key] = input[key];
+	}
+	if (typeof input.client_secret !== "string" || input.client_secret.length > 8192)
+		throw new errs.ValidationError("Invalid client secret");
+	if (input.client_secret) config.client_secret = input.client_secret;
+	try {
+		validateConfig(config);
+	} catch (error) {
+		throw new errs.ValidationError(error.message);
+	}
+	const revision = random();
+	if (config.enabled) {
+		try {
+			await discover(config, revision);
+		} catch {
+			throw new errs.ValidationError("Unable to discover OIDC provider over HTTPS");
+		}
+	}
+	const stored = {
+		...config,
+		client_secret: config.client_secret ? seal(config.client_secret, getPrivateKey()) : "",
+	};
+	await db().transaction(async (trx) => {
+		const row = await trx("oidc_config").where({ id: 1 }).first();
+		if ((row?.revision || "initial") !== previous.revision)
+			throw new errs.ValidationError("OIDC settings changed; reload and retry");
+		if (row) {
+			const n = await trx("oidc_config")
+				.where({ id: 1, revision: previous.revision })
+				.update({ config: JSON.stringify(stored), revision });
+			if (n !== 1) throw new errs.ValidationError("OIDC settings changed; retry");
+		} else await trx("oidc_config").insert({ id: 1, config: JSON.stringify(stored), revision });
+	});
+	return publicConfig({ config, revision });
+}
+export async function activeUser(id) {
+	const user = await userModel.query().where({ id, is_deleted: 0, is_disabled: 0 }).first();
+	if (!user) throw new errs.AuthError("Account is unavailable");
+	return user;
+}
+export async function authenticationStamp(id) {
+	await activeUser(id);
+	const auth = await authModel.query().where({ user_id: id, type: "password", is_deleted: 0 }).first();
+	return authStamp(auth);
+}
+export async function canUnlinkIdentity(id) {
+	const auth = await authModel.query().where({ user_id: id, type: "password", is_deleted: 0 }).first();
+	return typeof auth?.secret === "string" && auth.secret.length > 0;
+}
+export async function linkIdentity(id, issuer, subject, stamp, revision) {
+	await activeUser(id);
+	await db().transaction(async (trx) => {
+		const provider = await trx("oidc_config").where({ id: 1 }).forUpdate().first();
+		if (!provider || provider.revision !== revision || JSON.parse(provider.config).enabled !== true)
+			throw new errs.AuthError("OIDC configuration changed; start linking again");
+		const auth = await authModel
+			.query(trx)
+			.where({ user_id: id, type: "password", is_deleted: 0 })
+			.forUpdate()
+			.first();
+		if (authStamp(auth) !== stamp) throw new errs.AuthError("Local authentication changed; start linking again");
+		const user = await userModel.query(trx).where({ id, is_deleted: 0, is_disabled: 0 }).first();
+		if (!user) throw new errs.AuthError("Account is unavailable");
+		const current = await trx("oidc_identity").where({ user_id: id }).first();
+		if (current) throw new errs.ValidationError("An OIDC identity is already linked");
+		const key = identityKey(issuer, subject);
+		const existing = await trx("oidc_identity").where({ identity_key: key }).forUpdate().first();
+		if (existing) {
+			const owner = await userModel.query(trx).where({ id: existing.user_id }).forUpdate().first();
+			if (!owner?.is_deleted) throw new errs.ValidationError("Identity is already linked to another account");
+			await trx("oidc_identity").where({ id: existing.id }).delete();
+		}
+		await trx("oidc_identity").insert({ user_id: id, identity_key: key, issuer, subject });
+	});
+}
+export async function linkedUser(issuer, subject) {
+	const row = await db()("oidc_identity")
+		.where({ identity_key: identityKey(issuer, subject) })
+		.first();
+	if (!row || row.issuer !== issuer || row.subject !== subject)
+		throw new errs.AuthError("Identity is not linked to an NPM account");
+	return activeUser(row.user_id);
+}
+export async function loginResult(user) {
+	await activeUser(user.id);
+	const auth = await authModel.query().where({ user_id: user.id, type: "password", is_deleted: 0 }).first();
+	if (auth?.meta?.totp_enabled === true) {
+		const signed = await TokenModel().create({
+			iss: "api",
+			attrs: { id: user.id },
+			scope: ["2fa-challenge"],
+			expiresIn: "5m",
+		});
+		return { requires_2fa: true, challenge_token: signed.token };
+	}
+	const result = await internalToken.getTokenFromUser(user);
+	return { token: result.token, expires: result.expires };
+}
diff --git a/backend/lib/oidc.js b/backend/lib/oidc.js
new file mode 100644
index 0000000000..0e0cccc5c4
--- /dev/null
+++ b/backend/lib/oidc.js
@@ -0,0 +1,112 @@
+import crypto from "node:crypto";
+import { LRUCache } from "lru-cache";
+import * as client from "openid-client";
+
+export const random = () => crypto.randomBytes(32).toString("base64url");
+export const identityKey = (issuer, subject) =>
+	crypto
+		.createHash("sha256")
+		.update(JSON.stringify([issuer, subject]))
+		.digest("hex");
+
+export function validateConfig(value) {
+	if (!["auto", "client_secret_basic", "client_secret_post"].includes(value.token_auth_method || "auto"))
+		throw new Error("Invalid token authentication method");
+	if (typeof value.enabled !== "boolean" || typeof value.auto_login !== "boolean")
+		throw new Error("Invalid OIDC switches");
+	for (const key of ["issuer", "public_url"]) {
+		if (!value.enabled && value[key] === "") continue;
+		const url = new URL(value[key]);
+		if (url.protocol !== "https:" || url.username || url.password || url.search || url.hash)
+			throw new Error("OIDC URLs must use HTTPS without credentials, query or fragment");
+		if (key === "public_url" && url.pathname !== "/") throw new Error("Public URL must be an HTTPS origin");
+	}
+	if (!value.enabled) return;
+	if (!value.client_id || !value.client_secret) throw new Error("Client ID and secret are required");
+	if (!value.scopes.split(/\s+/).includes("openid")) throw new Error("Scopes must include openid");
+}
+
+// Secrets are encrypted using a key derived from NPM's existing persistent key.
+export function seal(value, privateKey) {
+	const key = crypto.createHash("sha256").update(privateKey).digest();
+	const iv = crypto.randomBytes(12);
+	const cipher = crypto.createCipheriv("aes-256-gcm", key, iv);
+	const encrypted = Buffer.concat([cipher.update(value, "utf8"), cipher.final()]);
+	return [iv, cipher.getAuthTag(), encrypted].map((v) => v.toString("base64url")).join(".");
+}
+export function unseal(value, privateKey) {
+	const [iv, tag, encrypted] = value.split(".").map((v) => Buffer.from(v, "base64url"));
+	const decipher = crypto.createDecipheriv(
+		"aes-256-gcm",
+		crypto.createHash("sha256").update(privateKey).digest(),
+		iv,
+	);
+	decipher.setAuthTag(tag);
+	return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString("utf8");
+}
+
+export class OneTimeStore {
+	constructor(ttl = 300000) {
+		this.cache = new LRUCache({ max: 1000, ttl });
+	}
+	put(value) {
+		const key = random();
+		this.cache.set(key, value);
+		return key;
+	}
+	take(key) {
+		const value = this.cache.get(key);
+		this.cache.delete(key);
+		return value;
+	}
+}
+
+const discoveries = new LRUCache({ max: 8, ttl: 300000 });
+export const clientAuthentication =
+	(secret, method = "auto") =>
+	(metadata, info, body, headers) => {
+		const methods = metadata.token_endpoint_auth_methods_supported || ["client_secret_basic"];
+		if (method === "client_secret_basic" || (method === "auto" && methods.includes("client_secret_basic")))
+			return client.ClientSecretBasic(secret)(metadata, info, body, headers);
+		if (method === "client_secret_post" || (method === "auto" && methods.includes("client_secret_post")))
+			return client.ClientSecretPost(secret)(metadata, info, body, headers);
+		throw new Error("Provider must support client_secret_basic or client_secret_post");
+	};
+export async function discover(config, revision) {
+	let pending = discoveries.get(revision);
+	if (!pending) {
+		pending = client
+			.discovery(
+				new URL(config.issuer),
+				config.client_id,
+				{ client_secret: config.client_secret },
+				clientAuthentication(config.client_secret, config.token_auth_method),
+				{ timeout: 15, execute: [client.enableNonRepudiationChecks] },
+			)
+			.then((result) => {
+				const metadata = result.serverMetadata();
+				for (const value of [metadata.authorization_endpoint, metadata.token_endpoint, metadata.jwks_uri]) {
+					const url = new URL(value);
+					if (url.protocol !== "https:" || url.username || url.password)
+						throw new Error("Insecure OIDC endpoint");
+				}
+				return result;
+			})
+			.catch((error) => {
+				discoveries.delete(revision);
+				throw error;
+			});
+		discoveries.set(revision, pending);
+	}
+	return pending;
+}
+
+export function sameOrigin(req, config) {
+	return (
+		req.get("Origin") === new URL(config.public_url).origin &&
+		(!req.get("Sec-Fetch-Site") || req.get("Sec-Fetch-Site") === "same-origin") &&
+		req.is("application/json")
+	);
+}
+
+export { client };
diff --git a/backend/migrations/20260918000000_oidc.js b/backend/migrations/20260918000000_oidc.js
new file mode 100644
index 0000000000..80d6b10932
--- /dev/null
+++ b/backend/migrations/20260918000000_oidc.js
@@ -0,0 +1,19 @@
+export async function up(knex) {
+	await knex.schema.createTable("oidc_config", (table) => {
+		table.integer("id").primary();
+		table.text("config").notNullable();
+		table.string("revision", 64).notNullable();
+	});
+	await knex.schema.createTable("oidc_identity", (table) => {
+		table.increments("id").primary();
+		table.integer("user_id").unsigned().notNullable().unique();
+		table.string("identity_key", 64).notNullable().unique();
+		table.text("issuer").notNullable();
+		table.text("subject").notNullable();
+	});
+}
+
+export async function down(knex) {
+	await knex.schema.dropTable("oidc_identity");
+	await knex.schema.dropTable("oidc_config");
+}
diff --git a/backend/package.json b/backend/package.json
index 0a73c6805a..9706c89beb 100644
--- a/backend/package.json
+++ b/backend/package.json
@@ -10,7 +10,8 @@
 		"lint": "biome lint",
 		"prettier": "biome format --write .",
 		"validate-schema": "node validate-schema.js",
-		"regenerate-config": "node scripts/regenerate-config"
+		"regenerate-config": "node scripts/regenerate-config",
+		"test:oidc": "node --experimental-test-module-mocks --test test/oidc.test.js"
 	},
 	"dependencies": {
 		"@apidevtools/json-schema-ref-parser": "^16.0.2",
@@ -22,6 +23,7 @@
 		"body-parser": "^2.3.0",
 		"chalk": "5.6.2",
 		"compression": "^1.8.2",
+		"cookie": "^1",
 		"express": "^5.2.1",
 		"express-fileupload": "^1.5.2",
 		"gravatar": "^1.8.2",
@@ -29,10 +31,12 @@
 		"knex": "3.3.0",
 		"liquidjs": "10.29.0",
 		"lodash": "^4.18.1",
+		"lru-cache": "^11",
 		"moment": "^2.30.1",
 		"mysql2": "^3.24.4",
 		"node-rsa": "^2.0.0",
 		"objection": "3.1.5",
+		"openid-client": "^6",
 		"otplib": "^13.5.0",
 		"path": "^0.12.7",
 		"pg": "^8.23.0",
diff --git a/backend/routes/main.js b/backend/routes/main.js
index a308ea6179..9805f47d47 100644
--- a/backend/routes/main.js
+++ b/backend/routes/main.js
@@ -12,6 +12,7 @@ import deadHostsRoutes from "./nginx/dead_hosts.js";
 import proxyHostsRoutes from "./nginx/proxy_hosts.js";
 import redirectionHostsRoutes from "./nginx/redirection_hosts.js";
 import streamsRoutes from "./nginx/streams.js";
+import oidcRoutes from "./oidc.js";
 import reportsRoutes from "./reports.js";
 import schemaRoutes from "./schema.js";
 import settingsRoutes from "./settings.js";
@@ -48,6 +49,7 @@ router.get("/", async (_, res /*, next*/) => {
 
 router.use("/schema", schemaRoutes);
 router.use("/tokens", tokensRoutes);
+router.use("/oidc", oidcRoutes);
 router.use("/users", usersRoutes);
 router.use("/audit-log", auditLogRoutes);
 router.use("/reports", reportsRoutes);
diff --git a/backend/routes/oidc.js b/backend/routes/oidc.js
new file mode 100644
index 0000000000..19c00c8c52
--- /dev/null
+++ b/backend/routes/oidc.js
@@ -0,0 +1,198 @@
+import { parse, serialize } from "cookie";
+import express from "express";
+import db from "../db.js";
+import * as service from "../internal/oidc.js";
+import Access from "../lib/access.js";
+import jwtdecode from "../lib/express/jwt-decode.js";
+import { client, discover, OneTimeStore, sameOrigin, validateConfig } from "../lib/oidc.js";
+
+const router = express.Router();
+const transactions = new OneTimeStore();
+const handoffs = new OneTimeStore(60000);
+const txCookie = "__Host-npm_oidc_tx";
+const handoffCookie = "__Host-npm_oidc_handoff";
+const cookieOptions = { path: "/", httpOnly: true, secure: true, sameSite: "lax" };
+const putCookie = (res, name, value, maxAge) =>
+	res.append("Set-Cookie", serialize(name, value, { ...cookieOptions, maxAge }));
+const clearCookie = (res, name) => putCookie(res, name, "", 0);
+const handler = (fn) => async (req, res, _next) => {
+	try {
+		await fn(req, res);
+	} catch {
+		res.status(400).json({ error: { message: "OIDC request failed. Check settings or use local login." } });
+	}
+};
+const requireUser = async (res) => {
+	const id = res.locals.access.token.getUserId();
+	await res.locals.access.can("users:get", id);
+	return id;
+};
+
+// Do not inherit the API's permissive credentialed CORS for cookie endpoints.
+router.use((_req, res, next) => {
+	res.removeHeader("Access-Control-Allow-Origin");
+	res.removeHeader("Access-Control-Allow-Credentials");
+	res.set({ "Cache-Control": "no-store", "Referrer-Policy": "no-referrer" });
+	next();
+});
+router.get(
+	"/status",
+	handler(async (_req, res) => {
+		const { config } = await service.readConfig();
+		res.json({ enabled: config.enabled, auto_login: config.auto_login });
+	}),
+);
+router.get(
+	"/settings",
+	jwtdecode(),
+	handler(async (_req, res) => {
+		await res.locals.access.can("settings:get", "oidc");
+		res.json(service.publicConfig(await service.readConfig()));
+	}),
+);
+router.put("/settings", jwtdecode(), async (req, res, next) => {
+	try {
+		res.json(await service.saveConfig(res.locals.access, req.body));
+	} catch (error) {
+		next(error);
+	}
+});
+router.get(
+	"/identity",
+	jwtdecode(),
+	handler(async (_req, res) => {
+		const id = await requireUser(res);
+		await service.activeUser(id);
+		const row = await db()("oidc_identity").where({ user_id: id }).first();
+		const { config } = await service.readConfig();
+		let available = false;
+		try {
+			validateConfig(config);
+			available = config.enabled;
+		} catch {
+			/* Incomplete provider configuration. */
+		}
+		res.json({
+			linked: !!row,
+			issuer: row?.issuer || "",
+			available,
+			can_unlink: await service.canUnlinkIdentity(id),
+		});
+	}),
+);
+router.post(
+	"/unlink",
+	jwtdecode(),
+	handler(async (req, res) => {
+		// Local account management must work after the provider is removed. The
+		// bearer session is mandatory; never use forwarded headers as a trust source.
+		if (!req.is("application/json") || (req.get("Sec-Fetch-Site") && req.get("Sec-Fetch-Site") !== "same-origin"))
+			return res.sendStatus(403);
+		// NPM's internal nginx forwards $host without its port. Sec-Fetch-Site
+		// checks modern browser origins; hostname comparison covers older clients.
+		if (req.get("Origin") && new URL(req.get("Origin")).hostname !== new URL(`http://${req.get("Host")}`).hostname)
+			return res.sendStatus(403);
+		const id = await requireUser(res);
+		if (!(await service.canUnlinkIdentity(id)))
+			return res
+				.status(409)
+				.json({ error: { message: "Set a local password before unlinking your last login method" } });
+		await db()("oidc_identity").where({ user_id: id }).delete();
+		res.json({ linked: false });
+	}),
+);
+async function start(req, res, userId = null, stamp = null, token = null) {
+	const { config, revision } = await service.readConfig();
+	if (!config.enabled) return res.sendStatus(404);
+	validateConfig(config);
+	if (!sameOrigin(req, config)) return res.sendStatus(403);
+	const provider = await discover(config, revision);
+	const state = client.randomState();
+	const nonce = client.randomNonce();
+	const verifier = client.randomPKCECodeVerifier();
+	const tx = transactions.put({ state, nonce, verifier, revision, userId, stamp, token });
+	putCookie(res, txCookie, tx, 300);
+	const url = client.buildAuthorizationUrl(provider, {
+		redirect_uri: new URL("/api/oidc/callback", config.public_url).href,
+		scope: config.scopes,
+		state,
+		nonce,
+		code_challenge: await client.calculatePKCECodeChallenge(verifier),
+		code_challenge_method: "S256",
+	});
+	res.json({ url: url.href });
+}
+router.post(
+	"/start",
+	handler((req, res) => start(req, res)),
+);
+router.post(
+	"/link",
+	jwtdecode(),
+	handler(async (req, res) => {
+		const { config } = await service.readConfig();
+		if (!sameOrigin(req, config)) return res.sendStatus(403);
+		const id = await requireUser(res);
+		if (await db()("oidc_identity").where({ user_id: id }).first())
+			return res.status(409).json({ error: { message: "An OIDC identity is already linked" } });
+		const stamp = await service.authenticationStamp(id);
+		return start(req, res, id, stamp, res.locals.token);
+	}),
+);
+router.get("/callback", async (req, res) => {
+	try {
+		const tx = transactions.take(parse(req.headers.cookie || "")[txCookie]);
+		clearCookie(res, txCookie);
+		const { config, revision } = await service.readConfig();
+		if (!tx || !config.enabled || tx.revision !== revision) throw new Error("Invalid transaction");
+		const provider = await discover(config, revision);
+		const url = new URL("/api/oidc/callback", config.public_url);
+		url.search = req.originalUrl.split("?")[1] || "";
+		const tokens = await client.authorizationCodeGrant(provider, url, {
+			pkceCodeVerifier: tx.verifier,
+			expectedState: tx.state,
+			expectedNonce: tx.nonce,
+			idTokenExpected: true,
+		});
+		const claims = tokens.claims();
+		if (!claims?.sub) throw new Error("Missing subject");
+		const current = await service.readConfig();
+		if (current.revision !== revision || !current.config.enabled) throw new Error("Configuration changed");
+		if (tx.userId) {
+			// The original authenticated session must still be valid after the IdP round trip.
+			const access = new Access(tx.token);
+			await access.can("users:get", tx.userId);
+			if (access.token.getUserId() !== tx.userId) throw new Error("Account changed");
+			await service.linkIdentity(tx.userId, claims.iss, claims.sub, tx.stamp, revision);
+			return res.redirect(303, new URL("/?oidc=linked", config.public_url).href);
+		}
+		const user = await service.linkedUser(claims.iss, claims.sub);
+		putCookie(
+			res,
+			handoffCookie,
+			handoffs.put({ userId: user.id, issuer: claims.iss, subject: claims.sub, revision }),
+			60,
+		);
+		res.redirect(303, new URL("/?oidc=complete", config.public_url).href);
+	} catch {
+		res.status(401)
+			.type("html")
+			.send(
+				'<!doctype html><meta name="referrer" content="no-referrer"><p>OIDC login failed. Sign in locally to link your account or check the provider configuration.</p><a href="/?local=1">Local login</a>',
+			);
+	}
+});
+router.post(
+	"/exchange",
+	handler(async (req, res) => {
+		const { config, revision } = await service.readConfig();
+		if (!sameOrigin(req, config)) return res.sendStatus(403);
+		const handoff = handoffs.take(parse(req.headers.cookie || "")[handoffCookie]);
+		clearCookie(res, handoffCookie);
+		if (!handoff || !config.enabled || handoff.revision !== revision) return res.sendStatus(401);
+		const user = await service.linkedUser(handoff.issuer, handoff.subject);
+		if (user.id !== handoff.userId) return res.sendStatus(401);
+		res.json(await service.loginResult(user));
+	}),
+);
+export default router;
diff --git a/backend/schema/components/oidc-error.json b/backend/schema/components/oidc-error.json
new file mode 100644
index 0000000000..955ae40e78
--- /dev/null
+++ b/backend/schema/components/oidc-error.json
@@ -0,0 +1,22 @@
+{
+	"type": "object",
+	"required": [
+		"error"
+	],
+	"properties": {
+		"error": {
+			"type": "object",
+			"required": [
+				"message"
+			],
+			"properties": {
+				"message": {
+					"type": "string"
+				},
+				"code": {
+					"type": "integer"
+				}
+			}
+		}
+	}
+}
diff --git a/backend/schema/components/oidc-settings-object.json b/backend/schema/components/oidc-settings-object.json
new file mode 100644
index 0000000000..e5b6b2ff84
--- /dev/null
+++ b/backend/schema/components/oidc-settings-object.json
@@ -0,0 +1,56 @@
+{
+	"type": "object",
+	"required": [
+		"enabled",
+		"auto_login",
+		"issuer",
+		"public_url",
+		"client_id",
+		"scopes",
+		"token_auth_method",
+		"revision",
+		"client_secret_configured",
+		"callback_url"
+	],
+	"properties": {
+		"enabled": {
+			"type": "boolean"
+		},
+		"auto_login": {
+			"type": "boolean"
+		},
+		"issuer": {
+			"type": "string",
+			"description": "HTTPS issuer URL; may be empty when disabled."
+		},
+		"public_url": {
+			"type": "string",
+			"description": "HTTPS origin of the NPM admin interface; may be empty when disabled."
+		},
+		"client_id": {
+			"type": "string"
+		},
+		"scopes": {
+			"type": "string",
+			"description": "Space-separated scopes including openid when enabled."
+		},
+		"token_auth_method": {
+			"type": "string",
+			"enum": [
+				"auto",
+				"client_secret_basic",
+				"client_secret_post"
+			]
+		},
+		"revision": {
+			"type": "string",
+			"description": "Opaque revision used for optimistic concurrency."
+		},
+		"client_secret_configured": {
+			"type": "boolean"
+		},
+		"callback_url": {
+			"type": "string"
+		}
+	}
+}
diff --git a/backend/schema/paths/oidc/callback/get.json b/backend/schema/paths/oidc/callback/get.json
new file mode 100644
index 0000000000..ba55c982da
--- /dev/null
+++ b/backend/schema/paths/oidc/callback/get.json
@@ -0,0 +1,71 @@
+{
+	"tags": [
+		"oidc"
+	],
+	"operationId": "completeOidcCallback",
+	"summary": "Handle the provider authorization callback",
+	"description": "Browser redirect endpoint. Validates the authorization response, state, nonce and PKCE against a one-time transaction. Linking retains the existing NPM session; login creates a one-time handoff for POST /oidc/exchange. Unknown identities cannot create accounts.",
+	"security": [],
+	"parameters": [
+		{
+			"in": "cookie",
+			"name": "__Host-npm_oidc_tx",
+			"required": true,
+			"description": "Browser-bound transaction set by start or link.",
+			"schema": {
+				"type": "string"
+			}
+		},
+		{
+			"in": "query",
+			"name": "state",
+			"schema": {
+				"type": "string"
+			}
+		},
+		{
+			"in": "query",
+			"name": "code",
+			"schema": {
+				"type": "string"
+			}
+		},
+		{
+			"in": "query",
+			"name": "error",
+			"description": "Provider authorization error instead of a code.",
+			"schema": {
+				"type": "string"
+			}
+		}
+	],
+	"responses": {
+		"303": {
+			"description": "Redirect to the configured public origin with oidc=linked or oidc=complete.",
+			"headers": {
+				"Location": {
+					"schema": {
+						"type": "string",
+						"format": "uri"
+					}
+				},
+				"Set-Cookie": {
+					"description": "Clears the transaction cookie. Successful login also sets __Host-npm_oidc_handoff for one minute with Secure, HttpOnly, Path=/ and SameSite=Lax.",
+					"schema": {
+						"type": "string"
+					}
+				}
+			}
+		},
+		"401": {
+			"description": "OIDC callback rejected. Returns an HTML page with a local-login link.",
+			"content": {
+				"text/html": {
+					"schema": {
+						"type": "string"
+					}
+				}
+			}
+		}
+	}
+}
diff --git a/backend/schema/paths/oidc/exchange/post.json b/backend/schema/paths/oidc/exchange/post.json
new file mode 100644
index 0000000000..30f5808814
--- /dev/null
+++ b/backend/schema/paths/oidc/exchange/post.json
@@ -0,0 +1,82 @@
+{
+	"tags": [
+		"oidc"
+	],
+	"operationId": "exchangeOidcHandoff",
+	"summary": "Exchange an OIDC handoff for an NPM session",
+	"description": "Consumes the browser-bound handoff exactly once. Rechecks the linked local account and enabled provider. Local NPM 2FA remains required when configured.",
+	"security": [],
+	"parameters": [
+		{
+			"in": "header",
+			"name": "Origin",
+			"required": true,
+			"description": "Must exactly match the configured public HTTPS origin. Sec-Fetch-Site, if sent, must be same-origin.",
+			"schema": {
+				"type": "string",
+				"format": "uri"
+			}
+		},
+		{
+			"in": "cookie",
+			"name": "__Host-npm_oidc_handoff",
+			"required": true,
+			"schema": {
+				"type": "string"
+			}
+		}
+	],
+	"requestBody": {
+		"required": true,
+		"content": {
+			"application/json": {
+				"schema": {
+					"type": "object"
+				}
+			}
+		}
+	},
+	"responses": {
+		"200": {
+			"description": "Ordinary NPM token or a local 2FA challenge for POST /tokens/2fa.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"oneOf": [
+							{
+								"$ref": "../../../components/token-object.json"
+							},
+							{
+								"$ref": "../../../components/token-challenge.json"
+							}
+						]
+					}
+				}
+			},
+			"headers": {
+				"Set-Cookie": {
+					"description": "Clears the handoff cookie.",
+					"schema": {
+						"type": "string"
+					}
+				}
+			}
+		},
+		"400": {
+			"description": "Exchange failed or the local account is unavailable.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"$ref": "../../../components/oidc-error.json"
+					}
+				}
+			}
+		},
+		"401": {
+			"description": "Handoff missing, expired, consumed, unlinked, or invalidated by a configuration change."
+		},
+		"403": {
+			"description": "Request is not same-origin JSON."
+		}
+	}
+}
diff --git a/backend/schema/paths/oidc/identity/get.json b/backend/schema/paths/oidc/identity/get.json
new file mode 100644
index 0000000000..3493a566c4
--- /dev/null
+++ b/backend/schema/paths/oidc/identity/get.json
@@ -0,0 +1,61 @@
+{
+	"tags": [
+		"oidc"
+	],
+	"security": [
+		{
+			"bearerAuth": []
+		}
+	],
+	"operationId": "getOidcIdentity",
+	"summary": "Get the current user\u2019s OIDC link",
+	"description": "Requires a full authenticated NPM user session. Always refers to the bearer-token owner.",
+	"responses": {
+		"200": {
+			"description": "Current identity and available actions.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"type": "object",
+						"required": [
+							"linked",
+							"issuer",
+							"available",
+							"can_unlink"
+						],
+						"properties": {
+							"linked": {
+								"type": "boolean"
+							},
+							"issuer": {
+								"type": "string",
+								"description": "Linked issuer or an empty string."
+							},
+							"available": {
+								"type": "boolean",
+								"description": "A valid provider configuration is saved and enabled."
+							},
+							"can_unlink": {
+								"type": "boolean",
+								"description": "Whether a non-deleted local password record with a nonempty secret exists; independent of linked."
+							}
+						}
+					}
+				}
+			}
+		},
+		"400": {
+			"description": "Session is unavailable or lacks user access.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"$ref": "../../../components/oidc-error.json"
+					}
+				}
+			}
+		},
+		"401": {
+			"description": "Invalid or expired bearer token."
+		}
+	}
+}
diff --git a/backend/schema/paths/oidc/link/post.json b/backend/schema/paths/oidc/link/post.json
new file mode 100644
index 0000000000..db0b058f95
--- /dev/null
+++ b/backend/schema/paths/oidc/link/post.json
@@ -0,0 +1,93 @@
+{
+	"tags": [
+		"oidc"
+	],
+	"security": [
+		{
+			"bearerAuth": []
+		}
+	],
+	"operationId": "startOidcLink",
+	"summary": "Link OIDC to the current NPM account",
+	"description": "Requires a valid NPM user session and a saved, enabled provider. No repeated password or recent-login check. The session is revalidated after the provider callback. The identity is matched by issuer and subject, not email.",
+	"parameters": [
+		{
+			"in": "header",
+			"name": "Origin",
+			"required": true,
+			"description": "Must exactly match the configured public HTTPS origin. Sec-Fetch-Site, if sent, must be same-origin.",
+			"schema": {
+				"type": "string",
+				"format": "uri"
+			}
+		}
+	],
+	"requestBody": {
+		"required": true,
+		"content": {
+			"application/json": {
+				"schema": {
+					"type": "object"
+				}
+			}
+		}
+	},
+	"responses": {
+		"200": {
+			"description": "Navigate the browser to this provider authorization URL.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"type": "object",
+						"required": [
+							"url"
+						],
+						"properties": {
+							"url": {
+								"type": "string",
+								"format": "uri"
+							}
+						}
+					}
+				}
+			},
+			"headers": {
+				"Set-Cookie": {
+					"description": "Sets __Host-npm_oidc_tx for five minutes: Secure, HttpOnly, Path=/, SameSite=Lax. The callback requires this browser-bound cookie.",
+					"schema": {
+						"type": "string"
+					}
+				}
+			}
+		},
+		"400": {
+			"description": "Invalid OIDC configuration or provider discovery failure.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"$ref": "../../../components/oidc-error.json"
+					}
+				}
+			}
+		},
+		"401": {
+			"description": "Invalid or expired bearer token."
+		},
+		"403": {
+			"description": "Request is not same-origin JSON."
+		},
+		"404": {
+			"description": "OIDC is disabled."
+		},
+		"409": {
+			"description": "The account already has an OIDC link.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"$ref": "../../../components/oidc-error.json"
+					}
+				}
+			}
+		}
+	}
+}
diff --git a/backend/schema/paths/oidc/settings/get.json b/backend/schema/paths/oidc/settings/get.json
new file mode 100644
index 0000000000..3cd77ae6ef
--- /dev/null
+++ b/backend/schema/paths/oidc/settings/get.json
@@ -0,0 +1,40 @@
+{
+	"tags": [
+		"oidc"
+	],
+	"security": [
+		{
+			"bearerAuth": [
+				"admin"
+			]
+		}
+	],
+	"operationId": "getOidcSettings",
+	"summary": "Get OIDC settings",
+	"description": "Administrator only. The client secret is never returned.",
+	"responses": {
+		"200": {
+			"description": "Current settings and revision.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"$ref": "../../../components/oidc-settings-object.json"
+					}
+				}
+			}
+		},
+		"400": {
+			"description": "Permission denied or settings could not be read.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"$ref": "../../../components/oidc-error.json"
+					}
+				}
+			}
+		},
+		"401": {
+			"description": "Invalid or expired bearer token."
+		}
+	}
+}
diff --git a/backend/schema/paths/oidc/settings/put.json b/backend/schema/paths/oidc/settings/put.json
new file mode 100644
index 0000000000..fd2585648b
--- /dev/null
+++ b/backend/schema/paths/oidc/settings/put.json
@@ -0,0 +1,108 @@
+{
+	"tags": [
+		"oidc"
+	],
+	"security": [
+		{
+			"bearerAuth": [
+				"admin"
+			]
+		}
+	],
+	"operationId": "updateOidcSettings",
+	"summary": "Update OIDC settings",
+	"description": "Administrator only. The enabled configuration is checked by HTTPS discovery before saving. Supply the revision returned by GET; stale updates are rejected.",
+	"requestBody": {
+		"required": true,
+		"content": {
+			"application/json": {
+				"schema": {
+					"type": "object",
+					"required": [
+						"enabled",
+						"auto_login",
+						"issuer",
+						"public_url",
+						"client_id",
+						"client_secret",
+						"scopes",
+						"revision"
+					],
+					"properties": {
+						"enabled": {
+							"type": "boolean"
+						},
+						"auto_login": {
+							"type": "boolean"
+						},
+						"issuer": {
+							"type": "string",
+							"description": "HTTPS issuer URL; may be empty when disabled.",
+							"maxLength": 2048
+						},
+						"public_url": {
+							"type": "string",
+							"description": "HTTPS origin of the NPM admin interface; may be empty when disabled.",
+							"maxLength": 2048
+						},
+						"client_id": {
+							"type": "string",
+							"maxLength": 2048
+						},
+						"scopes": {
+							"type": "string",
+							"description": "Space-separated scopes including openid when enabled.",
+							"maxLength": 2048
+						},
+						"token_auth_method": {
+							"type": "string",
+							"enum": [
+								"auto",
+								"client_secret_basic",
+								"client_secret_post"
+							]
+						},
+						"revision": {
+							"type": "string",
+							"description": "Opaque revision used for optimistic concurrency."
+						},
+						"client_secret": {
+							"type": "string",
+							"maxLength": 8192,
+							"writeOnly": true,
+							"description": "A nonempty value replaces the secret. An empty string retains the saved secret. A secret is required to enable OIDC."
+						}
+					}
+				}
+			}
+		}
+	},
+	"responses": {
+		"200": {
+			"description": "Saved settings without the client secret.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"$ref": "../../../components/oidc-settings-object.json"
+					}
+				}
+			}
+		},
+		"400": {
+			"description": "Invalid fields, discovery failure, or stale revision.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"$ref": "../../../components/oidc-error.json"
+					}
+				}
+			}
+		},
+		"401": {
+			"description": "Invalid, expired or revoked bearer token."
+		},
+		"403": {
+			"description": "Administrator permission required."
+		}
+	}
+}
diff --git a/backend/schema/paths/oidc/start/post.json b/backend/schema/paths/oidc/start/post.json
new file mode 100644
index 0000000000..a5fd91a26b
--- /dev/null
+++ b/backend/schema/paths/oidc/start/post.json
@@ -0,0 +1,76 @@
+{
+	"tags": [
+		"oidc"
+	],
+	"operationId": "startOidcLogin",
+	"summary": "Start OIDC sign-in",
+	"description": "Uses Authorization Code with PKCE S256, state and nonce. No bearer token is required.",
+	"security": [],
+	"parameters": [
+		{
+			"in": "header",
+			"name": "Origin",
+			"required": true,
+			"description": "Must exactly match the configured public HTTPS origin. Sec-Fetch-Site, if sent, must be same-origin.",
+			"schema": {
+				"type": "string",
+				"format": "uri"
+			}
+		}
+	],
+	"requestBody": {
+		"required": true,
+		"content": {
+			"application/json": {
+				"schema": {
+					"type": "object"
+				}
+			}
+		}
+	},
+	"responses": {
+		"200": {
+			"description": "Navigate the browser to this provider authorization URL.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"type": "object",
+						"required": [
+							"url"
+						],
+						"properties": {
+							"url": {
+								"type": "string",
+								"format": "uri"
+							}
+						}
+					}
+				}
+			},
+			"headers": {
+				"Set-Cookie": {
+					"description": "Sets __Host-npm_oidc_tx for five minutes: Secure, HttpOnly, Path=/, SameSite=Lax. The callback requires this browser-bound cookie.",
+					"schema": {
+						"type": "string"
+					}
+				}
+			}
+		},
+		"400": {
+			"description": "Invalid OIDC configuration or provider discovery failure.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"$ref": "../../../components/oidc-error.json"
+					}
+				}
+			}
+		},
+		"403": {
+			"description": "Request is not same-origin JSON."
+		},
+		"404": {
+			"description": "OIDC is disabled."
+		}
+	}
+}
diff --git a/backend/schema/paths/oidc/status/get.json b/backend/schema/paths/oidc/status/get.json
new file mode 100644
index 0000000000..931c15e8c8
--- /dev/null
+++ b/backend/schema/paths/oidc/status/get.json
@@ -0,0 +1,42 @@
+{
+	"tags": [
+		"oidc"
+	],
+	"operationId": "getOidcStatus",
+	"summary": "Get public OIDC availability",
+	"security": [],
+	"responses": {
+		"200": {
+			"description": "OIDC login availability and automatic-login setting.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"type": "object",
+						"required": [
+							"enabled",
+							"auto_login"
+						],
+						"properties": {
+							"enabled": {
+								"type": "boolean"
+							},
+							"auto_login": {
+								"type": "boolean"
+							}
+						}
+					}
+				}
+			}
+		},
+		"400": {
+			"description": "Configuration could not be read.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"$ref": "../../../components/oidc-error.json"
+					}
+				}
+			}
+		}
+	}
+}
diff --git a/backend/schema/paths/oidc/unlink/post.json b/backend/schema/paths/oidc/unlink/post.json
new file mode 100644
index 0000000000..e4886c25c1
--- /dev/null
+++ b/backend/schema/paths/oidc/unlink/post.json
@@ -0,0 +1,70 @@
+{
+	"tags": [
+		"oidc"
+	],
+	"security": [
+		{
+			"bearerAuth": []
+		}
+	],
+	"operationId": "unlinkOidcIdentity",
+	"summary": "Unlink the current user\u2019s OIDC identity",
+	"description": "Requires a valid NPM user session and a JSON request. Works even after the OIDC provider is disabled or removed. A supplied Sec-Fetch-Site must be same-origin; a supplied Origin must match the request hostname.",
+	"requestBody": {
+		"required": true,
+		"content": {
+			"application/json": {
+				"schema": {
+					"type": "object"
+				}
+			}
+		}
+	},
+	"responses": {
+		"200": {
+			"description": "OIDC identity removed.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"type": "object",
+						"required": [
+							"linked"
+						],
+						"properties": {
+							"linked": {
+								"type": "boolean",
+								"const": false
+							}
+						}
+					}
+				}
+			}
+		},
+		"400": {
+			"description": "Session unavailable or unlink failed.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"$ref": "../../../components/oidc-error.json"
+					}
+				}
+			}
+		},
+		"401": {
+			"description": "Invalid or expired bearer token."
+		},
+		"403": {
+			"description": "Request is not same-origin JSON."
+		},
+		"409": {
+			"description": "Cannot remove the account\u2019s last login method.",
+			"content": {
+				"application/json": {
+					"schema": {
+						"$ref": "../../../components/oidc-error.json"
+					}
+				}
+			}
+		}
+	}
+}
diff --git a/backend/schema/swagger.json b/backend/schema/swagger.json
index 4222f19ddd..a9ce01ecf9 100644
--- a/backend/schema/swagger.json
+++ b/backend/schema/swagger.json
@@ -60,12 +60,59 @@
 			"name": "tokens",
 			"description": "Endpoints for managing authentication tokens"
 		},
+		{
+			"name": "oidc",
+			"description": "OpenID Connect configuration, account linking and sign-in"
+		},
 		{
 			"name": "users",
 			"description": "Endpoints for managing users"
 		}
 	],
 	"paths": {
+		"/oidc/status": {
+			"get": {
+				"$ref": "./paths/oidc/status/get.json"
+			}
+		},
+		"/oidc/settings": {
+			"get": {
+				"$ref": "./paths/oidc/settings/get.json"
+			},
+			"put": {
+				"$ref": "./paths/oidc/settings/put.json"
+			}
+		},
+		"/oidc/identity": {
+			"get": {
+				"$ref": "./paths/oidc/identity/get.json"
+			}
+		},
+		"/oidc/unlink": {
+			"post": {
+				"$ref": "./paths/oidc/unlink/post.json"
+			}
+		},
+		"/oidc/start": {
+			"post": {
+				"$ref": "./paths/oidc/start/post.json"
+			}
+		},
+		"/oidc/link": {
+			"post": {
+				"$ref": "./paths/oidc/link/post.json"
+			}
+		},
+		"/oidc/callback": {
+			"get": {
+				"$ref": "./paths/oidc/callback/get.json"
+			}
+		},
+		"/oidc/exchange": {
+			"post": {
+				"$ref": "./paths/oidc/exchange/post.json"
+			}
+		},
 		"/": {
 			"get": {
 				"$ref": "./paths/get.json"
diff --git a/backend/test/oidc.test.js b/backend/test/oidc.test.js
new file mode 100644
index 0000000000..f4468dd0f5
--- /dev/null
+++ b/backend/test/oidc.test.js
@@ -0,0 +1,459 @@
+import assert from "node:assert/strict";
+import crypto from "node:crypto";
+import { request as httpRequest } from "node:http";
+import { mock, test } from "node:test";
+import express from "express";
+import { exportJWK, generateKeyPair, SignJWT } from "jose";
+import knex from "knex";
+
+const keys = crypto.generateKeyPairSync("rsa", {
+	modulusLength: 2048,
+	privateKeyEncoding: { type: "pkcs8", format: "pem" },
+	publicKeyEncoding: { type: "spki", format: "pem" },
+});
+const database = knex({ client: "better-sqlite3", connection: { filename: ":memory:" }, useNullAsDefault: true });
+mock.module("../db.js", { defaultExport: () => database });
+mock.module("../lib/config.js", {
+	namedExports: {
+		isCI: () => true,
+		isDebugMode: () => false,
+		isSqlite: () => true,
+		isMysql: () => false,
+		isPostgres: () => false,
+		configHas: () => true,
+		configGet: () => ({}),
+		getPrivateKey: () => keys.privateKey,
+		getPublicKey: () => keys.publicKey,
+		useLetsencryptStaging: () => false,
+		useLetsencryptServer: () => null,
+	},
+});
+const { default: router } = await import("../routes/oidc.js");
+const { default: jwtMiddleware } = await import("../lib/express/jwt.js");
+const { default: Token } = await import("../models/token.js");
+const service = await import("../internal/oidc.js");
+const { default: Auth } = await import("../models/auth.js");
+const { default: User } = await import("../models/user.js");
+const { up, down } = await import("../migrations/20260918000000_oidc.js");
+const { validateConfig, seal, unseal, OneTimeStore, clientAuthentication } = await import("../lib/oidc.js");
+
+test("OIDC integration with standard-only signed tokens and existing NPM accounts", async (t) => {
+	await database.schema.createTable("user", (table) => {
+		table.increments("id");
+		table.string("email");
+		table.string("name");
+		table.string("nickname");
+		table.text("roles");
+		table.integer("is_deleted").defaultTo(0);
+		table.integer("is_disabled").defaultTo(0);
+		table.dateTime("created_on");
+		table.dateTime("modified_on");
+	});
+	await database.schema.createTable("auth", (table) => {
+		table.increments("id");
+		table.integer("user_id");
+		table.string("type");
+		table.text("secret");
+		table.text("meta");
+		table.integer("is_deleted").defaultTo(0);
+		table.dateTime("created_on");
+		table.dateTime("modified_on");
+	});
+	await database.schema.createTable("user_permission", (table) => {
+		table.increments("id");
+		table.integer("user_id");
+		table.string("visibility");
+		table.string("proxy_hosts");
+	});
+	await up(database);
+	await User.query().insert({ id: 1, email: "admin@example.com", name: "Admin", roles: ["admin"] });
+	await User.query().insert({ id: 2, email: "user@example.com", name: "User", roles: [] });
+	await database("user_permission").insert([
+		{ user_id: 1, visibility: "all", proxy_hosts: "manage" },
+		{ user_id: 2, visibility: "user", proxy_hosts: "view" },
+	]);
+	await Auth.query().insert({ user_id: 1, type: "password", secret: "current-password", meta: {} });
+	await Auth.query().insert({ user_id: 2, type: "password", secret: "current-password", meta: {} });
+	const admin = (await Token().create({ attrs: { id: 1 }, scope: ["user"], expiresIn: "1h" })).token;
+	const regular = (await Token().create({ attrs: { id: 2 }, scope: ["user"], expiresIn: "1h" })).token;
+	const challenge = (await Token().create({ attrs: { id: 1 }, scope: ["2fa-challenge"], expiresIn: "5m" })).token;
+	const app = express();
+	app.use(express.json());
+	app.use(jwtMiddleware());
+	app.use("/api/oidc", router);
+	app.use((e, _req, res, _next) => res.status(e.status || 500).json({ error: e.message }));
+	const server = await new Promise((resolve) => {
+		const s = app.listen(0, "127.0.0.1", () => resolve(s));
+	});
+	const base = `http://127.0.0.1:${server.address().port}`;
+	const origin = "https://npm.example";
+	const signing = await generateKeyPair("RS256");
+	const wrongSigning = await generateKeyPair("RS256");
+	const jwk = await exportJWK(signing.publicKey);
+	jwk.kid = "provider-key";
+	let nonce = "";
+	let pkce = "";
+	let variant = "";
+	let subject = "subject-1";
+	let discoveryCount = 0;
+	const nativeFetch = globalThis.fetch;
+	globalThis.fetch = async (input, options = {}) => {
+		const url = String(input);
+		if (!url.startsWith("https://id.example")) return nativeFetch(input, options);
+		if (url.includes(".well-known")) {
+			discoveryCount++;
+			return Response.json({
+				issuer: "https://id.example",
+				authorization_endpoint: "https://id.example/authorize",
+				token_endpoint: "https://id.example/token",
+				jwks_uri: "https://id.example/keys",
+				token_endpoint_auth_methods_supported: ["client_secret_basic"],
+				id_token_signing_alg_values_supported: ["RS256"],
+			});
+		}
+		if (url.endsWith("/keys")) return Response.json({ keys: [jwk] });
+		if (url.endsWith("/token")) {
+			const body = new URLSearchParams(options.body);
+			const headers = new Headers(options.headers);
+			assert.ok(headers.get("authorization")?.startsWith("Basic "));
+			assert.equal(crypto.createHash("sha256").update(body.get("code_verifier")).digest("base64url"), pkce);
+			const jwt = await new SignJWT({ nonce: variant === "nonce" ? "wrong" : nonce })
+				.setProtectedHeader({ alg: "RS256", kid: "provider-key" })
+				.setIssuer(variant === "issuer" ? "https://wrong.example" : "https://id.example")
+				.setSubject(subject)
+				.setAudience(variant === "audience" ? "wrong-client" : "test-client")
+				.setIssuedAt()
+				.setExpirationTime(variant === "expired" ? "-1h" : "1h")
+				.sign(variant === "signature" ? wrongSigning.privateKey : signing.privateKey);
+			return Response.json({ access_token: "not-retained", token_type: "Bearer", id_token: jwt });
+		}
+		throw new Error("Unexpected endpoint");
+	};
+	t.after(async () => {
+		globalThis.fetch = nativeFetch;
+		await new Promise((resolve) => server.close(resolve));
+		await database.destroy();
+	});
+	async function req(
+		path,
+		{ token, body, cookie, method = body ? "POST" : "GET", requestOrigin = origin, host } = {},
+	) {
+		const headers = {
+			"Content-Type": "application/json",
+			Origin: requestOrigin,
+			"Sec-Fetch-Site": "same-origin",
+			...(token ? { Authorization: `Bearer ${token}` } : {}),
+			...(cookie ? { Cookie: cookie } : {}),
+			...(host ? { Host: host } : {}),
+		};
+		if (host)
+			return new Promise((resolve, reject) => {
+				const request = httpRequest(`${base}/api/oidc/${path}`, { method, headers }, (response) => {
+					const chunks = [];
+					response.on("data", (chunk) => chunks.push(chunk));
+					response.on("end", () =>
+						resolve(
+							new Response(Buffer.concat(chunks), {
+								status: response.statusCode,
+								headers: response.headers,
+							}),
+						),
+					);
+				});
+				request.on("error", reject);
+				request.end(body ? JSON.stringify(body) : undefined);
+			});
+		return nativeFetch(`${base}/api/oidc/${path}`, {
+			method,
+			headers,
+			body: body ? JSON.stringify(body) : undefined,
+			redirect: "manual",
+		});
+	}
+	let config = {
+		enabled: true,
+		auto_login: true,
+		issuer: "https://id.example",
+		public_url: origin,
+		client_id: "test-client",
+		client_secret: "test-secret",
+		scopes: "openid",
+		revision: "initial",
+	};
+	await t.test("admin-only settings, encrypted secret and optimistic concurrency", async () => {
+		assert.notEqual((await req("settings", { token: regular })).status, 200);
+		let r = await req("settings", { token: admin, method: "PUT", body: config });
+		assert.equal(r.status, 200);
+		const v = await r.json();
+		assert.equal(v.client_secret, undefined);
+		assert.equal(v.client_secret_configured, true);
+		config = { ...config, revision: v.revision };
+		assert.ok(!(await database("oidc_config").first()).config.includes("test-secret"));
+		r = await req("settings", { token: admin, method: "PUT", body: { ...config, revision: "stale" } });
+		assert.equal(r.status, 400);
+		r = await req("settings", {
+			token: admin,
+			method: "PUT",
+			body: { ...config, enabled: false, public_url: "invalid" },
+		});
+		assert.equal(r.status, 400);
+		assert.equal((await service.readConfig()).config.public_url, origin);
+	});
+	async function start(token) {
+		const r = await req(token ? "link" : "start", { token, body: {} });
+		assert.equal(r.status, 200);
+		const url = new URL((await r.json()).url);
+		nonce = url.searchParams.get("nonce");
+		pkce = url.searchParams.get("code_challenge");
+		assert.equal(url.searchParams.get("code_challenge_method"), "S256");
+		return { state: url.searchParams.get("state"), cookie: r.headers.getSetCookie()[0].split(";")[0] };
+	}
+	const callback = (tx) => req(`callback?code=code&state=${tx.state}`, { cookie: tx.cookie });
+	await t.test("unknown identity rejected, linking preserves user and roles", async () => {
+		let tx = await start();
+		assert.equal((await callback(tx)).status, 401);
+		tx = await start(admin);
+		const r = await callback(tx);
+		assert.equal(r.status, 303);
+		assert.equal(r.headers.get("Location"), `${origin}/?oidc=linked`);
+		assert.equal((await database("user").where({ id: 1 }).first()).roles, '["admin"]');
+		assert.equal(
+			await database("user")
+				.count("id as count")
+				.first()
+				.then((v) => v.count),
+			2,
+		);
+		assert.equal((await callback(tx)).status, 401);
+	});
+	await t.test("signed standard-only ID token to one-time NPM token handoff", async () => {
+		const tx = await start();
+		const r = await callback(tx);
+		assert.equal(r.status, 303);
+		assert.equal(r.headers.get("Location"), `${origin}/?oidc=complete`);
+		const header = r.headers.getSetCookie().find((s) => s.startsWith("__Host-npm_oidc_handoff="));
+		assert.ok(header.includes("Secure") && header.includes("HttpOnly") && header.includes("SameSite=Lax"));
+		const cookie = header.split(";")[0];
+		const denied = await req("exchange", { body: {}, cookie, requestOrigin: "https://evil.example" });
+		assert.equal(denied.status, 403);
+		assert.equal(denied.headers.get("Access-Control-Allow-Origin"), null);
+		const ok = await req("exchange", { body: {}, cookie });
+		assert.equal(ok.status, 200);
+		const v = await ok.json();
+		const token = await Token().load(v.token);
+		assert.equal(token.attrs.id, 1);
+		assert.deepEqual(token.scope, ["user"]);
+		assert.equal((await req("exchange", { body: {}, cookie })).status, 401);
+	});
+	for (const invalid of ["state", "nonce", "issuer", "audience", "signature", "expired"]) {
+		await t.test(`reject invalid ${invalid}`, async () => {
+			variant = invalid;
+			const tx = await start();
+			if (invalid === "state") tx.state = "wrong";
+			assert.equal((await callback(tx)).status, 401);
+			variant = "";
+		});
+	}
+	await t.test("reject cross-browser state and challenge-token linking", async () => {
+		const tx = await start();
+		assert.equal((await callback({ ...tx, cookie: "" })).status, 401);
+		assert.notEqual((await req("identity", { token: challenge })).status, 200);
+		assert.notEqual((await req("link", { token: challenge, body: {} })).status, 200);
+		assert.notEqual((await req("link", { body: {} })).status, 200);
+		assert.equal((await req("start", { body: {}, requestOrigin: "https://evil.example" })).status, 403);
+	});
+	await t.test("disabled users and unlinked handoffs fail closed", async () => {
+		const tx = await start();
+		const r = await callback(tx);
+		const cookie = r.headers
+			.getSetCookie()
+			.find((s) => s.startsWith("__Host-npm_oidc_handoff="))
+			.split(";")[0];
+		await database("user").where({ id: 1 }).update({ is_disabled: 1 });
+		assert.notEqual((await req("exchange", { cookie, body: {} })).status, 200);
+		await database("user").where({ id: 1 }).update({ is_disabled: 0 });
+	});
+	await t.test("pending linking invalidated by password reset", async () => {
+		subject = "subject-2";
+		const tx = await start(regular);
+		await Auth.query().where({ user_id: 2, type: "password" }).patch({ secret: "new-password" });
+		assert.equal((await callback(tx)).status, 401);
+		assert.equal(await database("oidc_identity").where({ user_id: 2 }).first(), undefined);
+		subject = "subject-1";
+	});
+	await t.test("standard users link only themselves using a valid session without a password", async () => {
+		subject = "standard-subject";
+		const tx = await start(regular);
+		assert.equal((await callback(tx)).status, 303);
+		const row = await database("oidc_identity").where({ user_id: 2 }).first();
+		assert.equal(row.subject, subject);
+		assert.equal((await database("user").where({ id: 2 }).first()).roles, "[]");
+		const own = await req("identity?user_id=1", { token: regular });
+		assert.equal((await own.json()).issuer, "https://id.example");
+		assert.equal((await req("unlink", { token: regular, body: { user_id: 1 }, requestOrigin: base })).status, 200);
+		assert.ok(await database("oidc_identity").where({ user_id: 1 }).first());
+		assert.equal(await database("oidc_identity").where({ user_id: 2 }).first(), undefined);
+		subject = "subject-1";
+	});
+	await t.test("linking requires an enabled saved provider and rejects expired or disabled sessions", async () => {
+		const row = await database("oidc_config").where({ id: 1 }).first();
+		const saved = JSON.parse(row.config);
+		await database("oidc_config")
+			.where({ id: 1 })
+			.update({ config: JSON.stringify({ ...saved, enabled: false }) });
+		assert.equal((await (await req("identity", { token: regular })).json()).available, false);
+		assert.equal((await req("link", { token: regular, body: {} })).status, 404);
+		await database("oidc_config").where({ id: 1 }).update({ config: row.config });
+		const expired = (await Token().create({ attrs: { id: 2 }, scope: ["user"], expiresIn: "-1s" })).token;
+		assert.notEqual((await req("link", { token: expired, body: {} })).status, 200);
+		await database("user").where({ id: 2 }).update({ is_disabled: 1 });
+		assert.notEqual((await req("link", { token: regular, body: {} })).status, 200);
+		await database("user").where({ id: 2 }).update({ is_disabled: 0 });
+	});
+	await t.test("NPM two-factor remains required after OIDC", async () => {
+		const auth = await Auth.query().where({ user_id: 1, type: "password" }).first();
+		await Auth.query()
+			.where({ id: auth.id })
+			.patch({ meta: { totp_enabled: true } });
+		const result = await service.loginResult(await service.activeUser(1));
+		assert.equal(result.requires_2fa, true);
+		assert.equal(result.token, undefined);
+	});
+	await t.test("a session expiring during the IdP round trip cannot finish linking", async () => {
+		const short = (await Token().create({ attrs: { id: 2 }, scope: ["user"], expiresIn: "1s" })).token;
+		const tx = await start(short);
+		await new Promise((resolve) => setTimeout(resolve, 1100));
+		assert.equal((await callback(tx)).status, 401);
+		assert.equal(await database("oidc_identity").where({ user_id: 2 }).first(), undefined);
+	});
+	await t.test(
+		"valid-session accounts without passwords can link and sign in; unlink works after provider removal",
+		async () => {
+			await database("auth").where({ user_id: 2 }).delete();
+			subject = "passwordless-subject";
+			const tx = await start(regular);
+			assert.equal((await callback(tx)).status, 303);
+			const result = await service.loginResult(await service.linkedUser("https://id.example", subject));
+			assert.ok(result.token);
+			assert.equal(result.requires_2fa, undefined);
+			assert.equal((await (await req("identity", { token: regular })).json()).can_unlink, false);
+			assert.equal((await req("unlink", { token: regular, body: {}, requestOrigin: base })).status, 409);
+			assert.ok(await database("oidc_identity").where({ user_id: 2 }).first());
+			// An administrator can set a local password before the last login method is removed.
+			await Auth.query().insert({ user_id: 2, type: "password", secret: "restored-password", meta: {} });
+			assert.equal((await (await req("identity", { token: regular })).json()).can_unlink, true);
+			const row = await database("oidc_config").where({ id: 1 }).first();
+			const cfg = JSON.parse(row.config);
+			await database("oidc_config")
+				.where({ id: 1 })
+				.update({ config: JSON.stringify({ ...cfg, enabled: false, public_url: "", issuer: "" }) });
+			assert.equal(
+				(await req("unlink", { token: regular, body: {}, requestOrigin: "https://evil.example" })).status,
+				403,
+			);
+			assert.equal(
+				(
+					await req("unlink", {
+						token: regular,
+						body: {},
+						requestOrigin: "http://nas.example:81",
+						host: "nas.example",
+					})
+				).status,
+				200,
+			);
+			assert.equal(await database("oidc_identity").where({ user_id: 2 }).first(), undefined);
+			await database("oidc_config").where({ id: 1 }).update({ config: row.config });
+			subject = "subject-1";
+		},
+	);
+	for (const enabled of [false, true]) {
+		await t.test(`provider ${enabled ? "replacement" : "disable"} during callback prevents linking`, async () => {
+			subject = "provider-change-subject";
+			const tx = await start(regular);
+			const saved = await database("oidc_config").where({ id: 1 }).first();
+			const originalQuery = Auth.query;
+			let changed = false;
+			// The callback has checked its revision before Access loads this auth row.
+			// Commit an administrator's update before the identity transaction starts.
+			Auth.query = function (...args) {
+				const query = originalQuery.apply(this, args);
+				const originalFirst = query.first;
+				query.first = async function (...values) {
+					const result = await originalFirst.apply(this, values);
+					if (!changed) {
+						changed = true;
+						await database("oidc_config")
+							.where({ id: 1 })
+							.update({
+								config: JSON.stringify({ ...JSON.parse(saved.config), enabled }),
+								revision: "provider-changed-during-callback",
+							});
+					}
+					return result;
+				};
+				return query;
+			};
+			try {
+				assert.equal((await callback(tx)).status, 401);
+				assert.equal(changed, true);
+				assert.equal(await database("oidc_identity").where({ user_id: 2 }).first(), undefined);
+			} finally {
+				Auth.query = originalQuery;
+				await database("oidc_identity").where({ user_id: 2 }).delete();
+				await database("oidc_config")
+					.where({ id: 1 })
+					.update({ config: saved.config, revision: saved.revision });
+				subject = "subject-1";
+			}
+		});
+	}
+	await t.test("only a deleted owner's identity can be linked to a replacement account", async () => {
+		await User.query().insert({ id: 3, email: "replacement@example.com", name: "Replacement", roles: [] });
+		await database("user_permission").insert({ user_id: 3, visibility: "user", proxy_hosts: "view" });
+		const replacement = (await Token().create({ attrs: { id: 3 }, scope: ["user"], expiresIn: "1h" })).token;
+		subject = "subject-1";
+		for (const disabled of [0, 1]) {
+			await database("user").where({ id: 1 }).update({ is_disabled: disabled });
+			const tx = await start(replacement);
+			assert.equal((await callback(tx)).status, 401);
+			assert.ok(await database("oidc_identity").where({ user_id: 1 }).first());
+			assert.equal(await database("oidc_identity").where({ user_id: 3 }).first(), undefined);
+		}
+		await database("user").where({ id: 1 }).update({ is_deleted: 1 });
+		const tx = await start(replacement);
+		assert.equal((await callback(tx)).status, 303);
+		assert.equal(await database("oidc_identity").where({ user_id: 1 }).first(), undefined);
+		assert.equal((await service.linkedUser("https://id.example", subject)).id, 3);
+		assert.equal((await database("user").where({ id: 3 }).first()).roles, "[]");
+	});
+	assert.ok(discoveryCount < 4);
+	await down(database);
+	assert.equal(await database.schema.hasTable("oidc_identity"), false);
+});
+
+test("configuration, encryption and one-time store", () => {
+	assert.throws(() => validateConfig({ enabled: false, auto_login: false, issuer: "", public_url: "bad" }));
+	const value = seal("secret", keys.privateKey);
+	assert.equal(unseal(value, keys.privateKey), "secret");
+	assert.throws(() => unseal(value, keys.publicKey));
+	const store = new OneTimeStore();
+	const key = store.put({ ok: true });
+	assert.deepEqual(store.take(key), { ok: true });
+	assert.equal(store.take(key), undefined);
+	for (const method of ["client_secret_basic", "client_secret_post"]) {
+		const body = new URLSearchParams();
+		const headers = new Headers();
+		clientAuthentication("secret", method)(
+			{ token_endpoint_auth_methods_supported: ["client_secret_basic", "client_secret_post"] },
+			{ client_id: "client" },
+			body,
+			headers,
+		);
+		if (method === "client_secret_basic") assert.ok(headers.get("authorization")?.startsWith("Basic "));
+		else {
+			assert.equal(headers.get("authorization"), null);
+			assert.equal(body.get("client_secret"), "secret");
+		}
+	}
+});
diff --git a/backend/yarn.lock b/backend/yarn.lock
index 6e2ab5dbcf..dc43259fae 100644
--- a/backend/yarn.lock
+++ b/backend/yarn.lock
@@ -607,6 +607,11 @@ cookie@^0.7.1:
   resolved "https://registry.yarnpkg.com/cookie/-/cookie-0.7.2.tgz#556369c472a2ba910f2979891b526b3436237ed7"
   integrity sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w==
 
+cookie@^1:
+  version "1.1.1"
+  resolved "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/cookie/-/cookie-1.1.1.tgz#3bb9bdfc82369db9c2f69c93c9c3ceb310c88b3c"
+  integrity sha1-O7m9/II2nbnC9pyTycPOsxDIizw=
+
 core-util-is@~1.0.0:
   version "1.0.3"
   resolved "https://registry.yarnpkg.com/core-util-is/-/core-util-is-1.0.3.tgz#a6042d3634c2b27e9328f837b965fac83808db85"
@@ -1225,6 +1230,11 @@ isexe@^4.0.0:
   resolved "https://registry.yarnpkg.com/isexe/-/isexe-4.0.0.tgz#48f6576af8e87a18feb796b7ed5e2e5903b43dca"
   integrity sha512-FFUtZMpoZ8RqHS3XeXEmHWLA4thH+ZxCv2lOiPIn1Xc7CxrqhWzNSDzD+/chS/zbYezmiwWLdQC09JdQKmthOw==
 
+jose@^6.2.12:
+  version "6.2.12"
+  resolved "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/jose/-/jose-6.2.12.tgz#65663e146edd010b98ece83f81737d3aa95fd0d7"
+  integrity sha1-ZWY+FG7dAQuY7Og/gXN9Oqlf0Nc=
+
 js-yaml@^4.2.0:
   version "4.3.2"
   resolved "https://registry.yarnpkg.com/js-yaml/-/js-yaml-4.3.2.tgz#8e44fb14a2643c59726bb15787b5f1512cb3d3fb"
@@ -1386,6 +1396,11 @@ long@^5.3.2:
   resolved "https://registry.yarnpkg.com/long/-/long-5.3.2.tgz#1d84463095999262d7d7b7f8bfd4a8cc55167f83"
   integrity sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==
 
+lru-cache@^11:
+  version "11.5.2"
+  resolved "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/lru-cache/-/lru-cache-11.5.2.tgz#00e16665c90c620fba14a3c368732a976493f760"
+  integrity sha1-AOFmZckMYg+6FKPDaHMql2ST92A=
+
 lru-cache@^7.14.1:
   version "7.18.3"
   resolved "https://registry.yarnpkg.com/lru-cache/-/lru-cache-7.18.3.tgz#f793896e0fd0e954a59dfdd82f0773808df6aa89"
@@ -1587,6 +1602,11 @@ normalize-path@^3.0.0, normalize-path@~3.0.0:
   resolved "https://registry.yarnpkg.com/normalize-path/-/normalize-path-3.0.0.tgz#0dcd69ff23a1c9b11fd0978316644a0388216a65"
   integrity sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==
 
+oauth4webapi@^3.8.8:
+  version "3.8.8"
+  resolved "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/oauth4webapi/-/oauth4webapi-3.8.8.tgz#05b47975cb621cdfd5dad35cecfaf41170e15c79"
+  integrity sha1-BbR5dctiHN/V2tNc7Pr0EXDhXHk=
+
 object-inspect@^1.13.3, object-inspect@^1.13.4:
   version "1.13.4"
   resolved "https://registry.yarnpkg.com/object-inspect/-/object-inspect-1.13.4.tgz#8375265e21bc20d0fa582c22e1b13485d6e00213"
@@ -1620,6 +1640,14 @@ once@^1.3.1, once@^1.4.0:
   dependencies:
     wrappy "1"
 
+openid-client@^6:
+  version "6.8.8"
+  resolved "https://ms-feed-25.pkgs.visualstudio.com/1es-public/_packaging/npm-public/npm/registry/openid-client/-/openid-client-6.8.8.tgz#b18448b14c5468ef88b7c175bee6d80183d6331c"
+  integrity sha1-sYRIsUxUaO+It8F1vubYAYPWMxw=
+  dependencies:
+    jose "^6.2.12"
+    oauth4webapi "^3.8.8"
+
 otplib@^13.5.0:
   version "13.5.0"
   resolved "https://registry.yarnpkg.com/otplib/-/otplib-13.5.0.tgz#78b5d0d9edf83078d7fe37243bbcdd96d7a65d37"
diff --git a/docs/.vitepress/config.mts b/docs/.vitepress/config.mts
index b6f6f3f660..0085fc5beb 100644
--- a/docs/.vitepress/config.mts
+++ b/docs/.vitepress/config.mts
@@ -79,6 +79,7 @@ export default defineConfig({
 				items: [
 					// { text: 'Home', link: '/' },
 					{ text: "Guide", link: "/guide/" },
+					{ text: "OpenID Connect", link: "/guide/oidc" },
 					{ text: "Screenshots", link: "/screenshots/" },
 					{ text: "Setup Instructions", link: "/setup/" },
 					{ text: "Advanced Configuration", link: "/advanced-config/" },
diff --git a/docs/src/guide/oidc.md b/docs/src/guide/oidc.md
new file mode 100644
index 0000000000..bd3db70641
--- /dev/null
+++ b/docs/src/guide/oidc.md
@@ -0,0 +1,47 @@
+# OpenID Connect sign-in
+
+Nginx Proxy Manager can use a standard OIDC provider for sign-in. Enable it in
+Settings → OpenID Connect using an issuer URL, client ID, client secret and the
+public HTTPS URL of the NPM admin interface. Register the displayed callback
+(`https://npm.example.com/api/oidc/callback`) as an exact authorization callback.
+
+Use a confidential client with Authorization Code and PKCE S256. The default
+scope is `openid`; username, email and group claims are not required. Advanced
+options support automatic login and standard token-endpoint authentication
+methods (auto, client_secret_basic, client_secret_post).
+
+Open the user menu → Edit Profile → Login methods to link your own existing
+NPM account. Administrators and standard users use the same area. Linking and
+unlinking require a valid authenticated NPM user session, without another
+password prompt or a recent-login requirement. Linking is available only after
+an administrator saves and enables a valid OIDC provider.
+Accounts without a local password cannot unlink their only login method; an
+administrator must set a local password first. Deleting an NPM account releases
+its identity for an explicit link to another account; disabling it does not.
+Identities are bound by issuer + subject, not matching email or
+display name. Unknown identities cannot create accounts or gain administrator
+privileges. Original user roles and proxy-host ownership are retained.
+
+Configure the identity provider's client access policies separately. NPM still
+enforces its local user status, permissions and 2FA. Local password login remains
+available at `/?local=1` even when automatic OIDC login is enabled.
+
+The callback validates state, nonce, PKCE, signature, issuer, audience and token
+expiry through openid-client. It uses short-lived, one-time, browser-bound
+cookies to exchange for an ordinary NPM API token. Neither provider tokens nor
+NPM tokens are placed in URLs. Client secrets are encrypted using NPM's existing
+persistent key and never returned by settings APIs.
+
+The HTTPS public URL is explicit: untrusted Host/X-Forwarded headers are not used
+to choose the callback or token-exchange origin. Requests to cookie-bearing
+endpoints must be same-origin JSON requests. Keep normal reverse-proxy forwarding
+for /api/oidc; do not place a second interactive login challenge on the callback.
+
+Signing out ends the local UI session, not the identity-provider session. Already
+issued NPM API tokens retain NPM's existing expiry/refresh behavior; provider
+revocation alone is not immediate local token revocation. Disable the NPM user
+to revoke local access immediately. Linking transactions expire after five
+minutes, handoffs after one minute; both are discarded on process restart.
+
+Configuration/identity migrations support the same SQLite, MySQL and PostgreSQL
+engines as NPM. Back up the database and /data/keys.json together before upgrades.
diff --git a/frontend/src/api/backend/oidc.test.ts b/frontend/src/api/backend/oidc.test.ts
new file mode 100644
index 0000000000..5ec281ca39
--- /dev/null
+++ b/frontend/src/api/backend/oidc.test.ts
@@ -0,0 +1,38 @@
+import { afterEach, expect, test, vi } from "vitest";
+import { getOIDCStatus, oidcRequest, startOIDC } from "./oidc";
+
+vi.mock("src/modules/AuthStore", () => ({ default: { token: null } }));
+afterEach(() => vi.unstubAllGlobals());
+
+test("settings validation retains the actionable public error", async () => {
+	vi.stubGlobal(
+		"fetch",
+		vi
+			.fn()
+			.mockResolvedValue(
+				Response.json({ error: { code: 400, message: "Scopes must include openid" } }, { status: 400 }),
+			),
+	);
+	await expect(oidcRequest("settings", "PUT", {})).rejects.toThrow("Scopes must include openid");
+});
+
+test("server and protocol failures retain a generic error", async () => {
+	const fetch = vi
+		.fn()
+		.mockResolvedValue(
+			Response.json({ error: { message: "provider response or internal details" } }, { status: 500 }),
+		);
+	vi.stubGlobal("fetch", fetch);
+	await expect(oidcRequest("settings", "PUT", {})).rejects.toThrow("Check the settings or sign in locally");
+	fetch.mockResolvedValue(Response.json({ error: { message: "provider response" } }, { status: 400 }));
+	await expect(oidcRequest("start", "POST", {})).rejects.toThrow("Check the settings or sign in locally");
+});
+
+test("status and start requests honor the login component cancellation signal", async () => {
+	const fetch = vi.fn().mockImplementation(() => Promise.resolve(Response.json({ url: "https://id.example" })));
+	vi.stubGlobal("fetch", fetch);
+	const { signal } = new AbortController();
+	await getOIDCStatus(signal);
+	await startOIDC(signal);
+	for (const call of fetch.mock.calls) expect(call[1].signal).toBe(signal);
+});
diff --git a/frontend/src/api/backend/oidc.ts b/frontend/src/api/backend/oidc.ts
new file mode 100644
index 0000000000..9586472acc
--- /dev/null
+++ b/frontend/src/api/backend/oidc.ts
@@ -0,0 +1,41 @@
+import { camelizeKeys, decamelizeKeys } from "humps";
+import AuthStore from "src/modules/AuthStore";
+import type { LoginResponse } from "./getToken";
+
+export interface OIDCSettings {
+	enabled: boolean;
+	autoLogin: boolean;
+	issuer: string;
+	publicUrl: string;
+	clientId: string;
+	clientSecret: string;
+	clientSecretConfigured: boolean;
+	scopes: string;
+	revision: string;
+	callbackUrl: string;
+	tokenAuthMethod: "auto" | "client_secret_basic" | "client_secret_post";
+}
+export async function oidcRequest<T>(path: string, method = "GET", data?: object, signal?: AbortSignal): Promise<T> {
+	const response = await fetch(`/api/oidc/${path}`, {
+		method,
+		signal,
+		headers: {
+			"Content-Type": "application/json",
+			...(AuthStore.token ? { Authorization: `Bearer ${AuthStore.token.token}` } : {}),
+		},
+		body: data ? JSON.stringify(decamelizeKeys(data)) : undefined,
+	});
+	if (!response.ok || response.redirected) {
+		let message = "OIDC request failed. Check the settings or sign in locally.";
+		if (!response.redirected && path === "settings" && response.status === 400) {
+			const payload = await response.json().catch(() => null);
+			if (typeof payload?.error?.message === "string") message = payload.error.message;
+		}
+		throw new Error(message);
+	}
+	return camelizeKeys(await response.json()) as T;
+}
+export const getOIDCStatus = (signal?: AbortSignal) =>
+	oidcRequest<{ enabled: boolean; autoLogin: boolean }>("status", "GET", undefined, signal);
+export const exchangeOIDC = (signal?: AbortSignal) => oidcRequest<LoginResponse>("exchange", "POST", {}, signal);
+export const startOIDC = (signal?: AbortSignal) => oidcRequest<{ url: string }>("start", "POST", {}, signal);
diff --git a/frontend/src/components/LoginMethods.test.tsx b/frontend/src/components/LoginMethods.test.tsx
new file mode 100644
index 0000000000..7e82f6208a
--- /dev/null
+++ b/frontend/src/components/LoginMethods.test.tsx
@@ -0,0 +1,52 @@
+import { cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import "@testing-library/jest-dom/vitest";
+import { afterEach, expect, test, vi } from "vitest";
+import { LoginMethods } from "./LoginMethods";
+
+const request = vi.hoisted(() => vi.fn());
+vi.mock("src/api/backend/oidc", () => ({ oidcRequest: request }));
+vi.mock("src/locale", () => ({ T: ({ id }: { id: string }) => id }));
+vi.mock("src/components", () => ({
+	Loading: () => null,
+	Button: ({ children, isLoading, actionType, ...props }: any) => <button {...props}>{children}</button>,
+}));
+afterEach(() => {
+	cleanup();
+	request.mockReset();
+	vi.restoreAllMocks();
+});
+test("disabled provider prevents linking, without any password fields", async () => {
+	request.mockResolvedValue({ linked: false, issuer: "", available: false });
+	render(<LoginMethods />);
+	expect(await screen.findByRole("button", { name: "oidc.link" })).toBeDisabled();
+	expect(screen.getByText("oidc.not-configured")).toBeVisible();
+	expect(document.querySelector('input[type="password"]')).toBeNull();
+});
+test("link uses the existing session with an empty payload", async () => {
+	request
+		.mockResolvedValueOnce({ linked: false, issuer: "", available: true })
+		.mockResolvedValueOnce({ url: "https://id.example/authorize" });
+	const navigate = vi.spyOn(window.location, "assign").mockImplementation(() => {});
+	render(<LoginMethods />);
+	fireEvent.click(await screen.findByRole("button", { name: "oidc.link" }));
+	await waitFor(() => expect(navigate).toHaveBeenCalledWith("https://id.example/authorize"));
+	expect(request).toHaveBeenLastCalledWith("link", "POST", {});
+});
+test("linked account can unlink using the same area", async () => {
+	request
+		.mockResolvedValueOnce({ linked: true, issuer: "https://id.example", available: true, canUnlink: true })
+		.mockResolvedValueOnce({ linked: false });
+	render(<LoginMethods />);
+	fireEvent.click(await screen.findByRole("button", { name: "oidc.unlink" }));
+	await screen.findByRole("button", { name: "oidc.link" });
+	expect(request).toHaveBeenLastCalledWith("unlink", "POST", {});
+});
+test("the only login method cannot be unlinked", async () => {
+	request.mockResolvedValue({ linked: true, issuer: "https://id.example", available: true, canUnlink: false });
+	render(<LoginMethods />);
+	const unlink = await screen.findByRole("button", { name: "oidc.unlink" });
+	expect(unlink).toBeDisabled();
+	expect(screen.getByText("oidc.last-login-method")).toBeVisible();
+	fireEvent.click(unlink);
+	expect(request).toHaveBeenCalledTimes(1);
+});
diff --git a/frontend/src/components/LoginMethods.tsx b/frontend/src/components/LoginMethods.tsx
new file mode 100644
index 0000000000..543f8697b9
--- /dev/null
+++ b/frontend/src/components/LoginMethods.tsx
@@ -0,0 +1,82 @@
+import { useEffect, useState } from "react";
+import { Alert } from "react-bootstrap";
+import { oidcRequest } from "src/api/backend/oidc";
+import { Button, Loading } from "src/components";
+import { T } from "src/locale";
+
+interface Identity {
+	linked: boolean;
+	issuer: string;
+	available: boolean;
+	canUnlink: boolean;
+}
+
+// Both administrator and standard accounts manage only their own identity here.
+export function LoginMethods() {
+	const [identity, setIdentity] = useState<Identity>();
+	const [error, setError] = useState("");
+	const [busy, setBusy] = useState(false);
+	useEffect(() => {
+		oidcRequest<Identity>("identity")
+			.then(setIdentity)
+			.catch((e) => setError(e.message));
+	}, []);
+	const act = async () => {
+		if (busy || !identity) return;
+		setBusy(true);
+		setError("");
+		try {
+			if (identity.linked) {
+				await oidcRequest("unlink", "POST", {});
+				setIdentity({ ...identity, linked: false, issuer: "" });
+				setBusy(false);
+			} else {
+				const { url } = await oidcRequest<{ url: string }>("link", "POST", {});
+				window.location.assign(url);
+			}
+		} catch (e) {
+			setError((e as Error).message);
+			setBusy(false);
+		}
+	};
+	return (
+		<>
+			{error && <Alert variant="danger">{error}</Alert>}
+			{!identity && !error && <Loading noLogo />}
+			{identity && (
+				<>
+					<h4>
+						<T id="oidc.title" />
+					</h4>
+					<p className="text-secondary">
+						<T id={identity.linked ? "oidc.linked" : "oidc.link-description"} />
+					</p>
+					{identity.linked && (
+						<p>
+							<code>{identity.issuer}</code>
+						</p>
+					)}
+					{!identity.available && (
+						<Alert variant="info">
+							<T id="oidc.not-configured" />
+						</Alert>
+					)}
+					{identity.linked && !identity.canUnlink && (
+						<Alert variant="info">
+							<T id="oidc.last-login-method" />
+						</Alert>
+					)}
+					<Button
+						type="button"
+						actionType={identity.linked ? undefined : "primary"}
+						disabled={busy || (identity.linked ? !identity.canUnlink : !identity.available)}
+						isLoading={busy}
+						onClick={act}
+					>
+						<T id={identity.linked ? "oidc.unlink" : "oidc.link"} />
+					</Button>
+				</>
+			)}
+		</>
+	);
+}
diff --git a/frontend/src/context/AuthContext.oidc.test.tsx b/frontend/src/context/AuthContext.oidc.test.tsx
new file mode 100644
index 0000000000..1058d86568
--- /dev/null
+++ b/frontend/src/context/AuthContext.oidc.test.tsx
@@ -0,0 +1,49 @@
+import { act, cleanup, render } from "@testing-library/react";
+import { afterEach, expect, test, vi } from "vitest";
+import { type AuthContextType, AuthProvider, useAuthState } from "./AuthContext";
+
+const mocks = vi.hoisted(() => ({ exchange: vi.fn(), setToken: vi.fn(), localLogin: vi.fn() }));
+vi.mock("src/api/backend/oidc", () => ({ exchangeOIDC: mocks.exchange }));
+vi.mock("src/api/backend", () => ({
+	getToken: mocks.localLogin,
+	isTwoFactorChallenge: (value: any) => value.requires2fa === true,
+}));
+vi.mock("src/modules/AuthStore", () => ({ default: { hasActiveToken: () => false, set: mocks.setToken } }));
+vi.mock("@tanstack/react-query", () => ({ useQueryClient: () => ({ clear: () => {} }) }));
+vi.mock("rooks", () => ({ useIntervalWhen: () => {} }));
+
+afterEach(() => {
+	cleanup();
+	vi.resetAllMocks();
+});
+
+test("an abandoned OIDC exchange cannot overwrite a completed local login", async () => {
+	let finish!: (value: unknown) => void;
+	mocks.exchange.mockReturnValue(
+		new Promise((resolve) => {
+			finish = resolve;
+		}),
+	);
+	const localToken = { token: "local-session", expires: "later" };
+	mocks.localLogin.mockResolvedValue(localToken);
+	let auth!: AuthContextType;
+	function Consumer() {
+		auth = useAuthState();
+		return null;
+	}
+	render(
+		<AuthProvider>
+			<Consumer />
+		</AuthProvider>,
+	);
+	const controller = new AbortController();
+	const pending = auth.completeOIDC(controller.signal);
+	await act(async () => auth.login("local@example.com", "local-password"));
+	controller.abort();
+	await act(async () => {
+		finish({ token: "late-oidc-session", expires: "later" });
+		await pending;
+	});
+	expect(mocks.setToken).toHaveBeenCalledTimes(1);
+	expect(mocks.setToken).toHaveBeenCalledWith(localToken);
+});
diff --git a/frontend/src/context/AuthContext.tsx b/frontend/src/context/AuthContext.tsx
index 34a67ec48d..31731be3b6 100644
--- a/frontend/src/context/AuthContext.tsx
+++ b/frontend/src/context/AuthContext.tsx
@@ -6,9 +6,10 @@ import {
 	isTwoFactorChallenge,
 	loginAsUser,
 	refreshToken,
-	verify2FA,
 	type TokenResponse,
+	verify2FA,
 } from "src/api/backend";
+import { exchangeOIDC } from "src/api/backend/oidc";
 import AuthStore from "src/modules/AuthStore";
 
 // 2FA challenge state
@@ -21,6 +22,7 @@ export interface AuthContextType {
 	authenticated: boolean;
 	twoFactorChallenge: TwoFactorChallenge | null;
 	login: (username: string, password: string) => Promise<void>;
+	completeOIDC: (signal?: AbortSignal) => Promise<void>;
 	verifyTwoFactor: (code: string) => Promise<void>;
 	cancelTwoFactor: () => void;
 	loginAs: (id: number) => Promise<void>;
@@ -63,6 +65,17 @@ function AuthProvider({ children, tokenRefreshInterval = 5 * 60 * 1000 }: Props)
 		const response = await verify2FA(twoFactorChallenge.challengeToken, code);
 		handleTokenUpdate(response);
 	};
+	const completeOIDC = async (signal?: AbortSignal) => {
+		const response = await exchangeOIDC(signal);
+		if (signal?.aborted) return;
+		window.history.replaceState(null, "", "/?local=1");
+		if (isTwoFactorChallenge(response)) {
+			setTwoFactorChallenge({ challengeToken: response.challengeToken });
+			return;
+		}
+		handleTokenUpdate(response);
+		window.history.replaceState(null, "", "/");
+	};
 
 	const cancelTwoFactor = () => {
 		setTwoFactorChallenge(null);
@@ -83,6 +96,7 @@ function AuthProvider({ children, tokenRefreshInterval = 5 * 60 * 1000 }: Props)
 			return;
 		}
 		AuthStore.clear();
+		window.history.replaceState(null, "", "/?local=1");
 		setAuthenticated(false);
 		queryClient.clear();
 	};
@@ -106,6 +120,7 @@ function AuthProvider({ children, tokenRefreshInterval = 5 * 60 * 1000 }: Props)
 		authenticated,
 		twoFactorChallenge,
 		login,
+		completeOIDC,
 		verifyTwoFactor,
 		cancelTwoFactor,
 		loginAs,
diff --git a/frontend/src/locale/src/en.json b/frontend/src/locale/src/en.json
index 88fdd724ed..035e32b926 100644
--- a/frontend/src/locale/src/en.json
+++ b/frontend/src/locale/src/en.json
@@ -566,6 +566,81 @@
 	"offline": {
 		"defaultMessage": "Offline"
 	},
+	"oidc.advanced": {
+		"defaultMessage": "Advanced options"
+	},
+	"oidc.auto-login": {
+		"defaultMessage": "Automatically start OIDC login"
+	},
+	"oidc.callback": {
+		"defaultMessage": "Callback URL"
+	},
+	"oidc.client-id": {
+		"defaultMessage": "Client ID"
+	},
+	"oidc.client-secret": {
+		"defaultMessage": "Client secret"
+	},
+	"oidc.description": {
+		"defaultMessage": "Configure a standard OIDC provider here. All users link their own account under Edit Profile → Login methods. Existing NPM roles and local login are preserved."
+	},
+	"oidc.enabled": {
+		"defaultMessage": "Enable OIDC"
+	},
+	"oidc.issuer": {
+		"defaultMessage": "Issuer URL"
+	},
+	"oidc.last-login-method": {
+		"defaultMessage": "This is your only login method. Ask an administrator to set a local password before unlinking."
+	},
+	"oidc.link": {
+		"defaultMessage": "Link account"
+	},
+	"oidc.link-description": {
+		"defaultMessage": "Link your current NPM account to the configured identity provider. Your current login is sufficient; no additional password is required."
+	},
+	"oidc.link-success": {
+		"defaultMessage": "OIDC account linked successfully."
+	},
+	"oidc.link-title": {
+		"defaultMessage": "OIDC account"
+	},
+	"oidc.linked": {
+		"defaultMessage": "An OIDC identity is linked to this account."
+	},
+	"oidc.login-methods": {
+		"defaultMessage": "Login methods"
+	},
+	"oidc.not-configured": {
+		"defaultMessage": "OIDC is not configured or enabled. Ask an administrator to complete Settings → OpenID Connect first."
+	},
+	"oidc.public-url": {
+		"defaultMessage": "Public URL"
+	},
+	"oidc.saved": {
+		"defaultMessage": "OIDC settings saved. Open Edit Profile → Login methods to link your account."
+	},
+	"oidc.secret-kept": {
+		"defaultMessage": "Configured. Leave blank to keep the existing secret."
+	},
+	"oidc.secret-new": {
+		"defaultMessage": "Enter the secret from your identity provider."
+	},
+	"oidc.sign-in": {
+		"defaultMessage": "Sign in with OIDC"
+	},
+	"oidc.signing-in": {
+		"defaultMessage": "Completing OIDC sign-in…"
+	},
+	"oidc.title": {
+		"defaultMessage": "OpenID Connect"
+	},
+	"oidc.token-auth": {
+		"defaultMessage": "Token endpoint authentication"
+	},
+	"oidc.unlink": {
+		"defaultMessage": "Unlink account"
+	},
 	"online": {
 		"defaultMessage": "Online"
 	},
diff --git a/frontend/src/locale/src/et.json b/frontend/src/locale/src/et.json
index a5b5393b3e..ad30881adc 100644
--- a/frontend/src/locale/src/et.json
+++ b/frontend/src/locale/src/et.json
@@ -566,6 +566,81 @@
 	"offline": {
 		"defaultMessage": "Maas"
 	},
+	"oidc.advanced": {
+		"defaultMessage": "Täpsemad seaded"
+	},
+	"oidc.auto-login": {
+		"defaultMessage": "Alusta OIDC sisselogimist automaatselt"
+	},
+	"oidc.callback": {
+		"defaultMessage": "Tagasisuunamise URL"
+	},
+	"oidc.client-id": {
+		"defaultMessage": "Kliendi ID"
+	},
+	"oidc.client-secret": {
+		"defaultMessage": "Kliendi saladus"
+	},
+	"oidc.description": {
+		"defaultMessage": "Seadista siin OIDC pakkuja. Kõik kasutajad seovad oma konto jaotises Muuda profiili → Sisselogimisviisid. Rollid ja kohalik sisselogimine säilivad."
+	},
+	"oidc.enabled": {
+		"defaultMessage": "Luba OIDC"
+	},
+	"oidc.issuer": {
+		"defaultMessage": "Väljastaja URL"
+	},
+	"oidc.last-login-method": {
+		"defaultMessage": "See on sinu ainus sisselogimisviis. Palu administraatoril enne seose eemaldamist määrata kohalik parool."
+	},
+	"oidc.link": {
+		"defaultMessage": "Seo konto"
+	},
+	"oidc.link-description": {
+		"defaultMessage": "Seo praegune NPM-i konto identiteedipakkujaga. Kehtiv sisselogimine on piisav; parooli uuesti sisestada pole vaja."
+	},
+	"oidc.link-success": {
+		"defaultMessage": "OIDC konto edukalt seotud."
+	},
+	"oidc.link-title": {
+		"defaultMessage": "OIDC konto"
+	},
+	"oidc.linked": {
+		"defaultMessage": "Selle kontoga on seotud OIDC identiteet."
+	},
+	"oidc.login-methods": {
+		"defaultMessage": "Sisselogimisviisid"
+	},
+	"oidc.not-configured": {
+		"defaultMessage": "OIDC pole seadistatud või lubatud. Palu administraatoril avada Seaded → OpenID Connect."
+	},
+	"oidc.public-url": {
+		"defaultMessage": "Avalik URL"
+	},
+	"oidc.saved": {
+		"defaultMessage": "OIDC seaded salvestatud. Konto sidumiseks ava Muuda profiili → Sisselogimisviisid."
+	},
+	"oidc.secret-kept": {
+		"defaultMessage": "Seadistatud. Olemasoleva saladuse säilitamiseks jäta tühjaks."
+	},
+	"oidc.secret-new": {
+		"defaultMessage": "Sisesta identiteedipakkuja antud saladus."
+	},
+	"oidc.sign-in": {
+		"defaultMessage": "Logi sisse OIDC-ga"
+	},
+	"oidc.signing-in": {
+		"defaultMessage": "OIDC sisselogimise lõpetamine…"
+	},
+	"oidc.title": {
+		"defaultMessage": "OpenID Connecti sisselogimine"
+	},
+	"oidc.token-auth": {
+		"defaultMessage": "Tokeni lõpp-punkti autentimine"
+	},
+	"oidc.unlink": {
+		"defaultMessage": "Eemalda seos"
+	},
 	"online": {
 		"defaultMessage": "Töös"
 	},
diff --git a/frontend/src/locale/src/zh.json b/frontend/src/locale/src/zh.json
index 72494bb64f..b0100419de 100644
--- a/frontend/src/locale/src/zh.json
+++ b/frontend/src/locale/src/zh.json
@@ -470,6 +470,81 @@
 	"offline": {
 		"defaultMessage": "离线"
 	},
+	"oidc.advanced": {
+		"defaultMessage": "高级选项"
+	},
+	"oidc.auto-login": {
+		"defaultMessage": "自动发起 OIDC 登录"
+	},
+	"oidc.callback": {
+		"defaultMessage": "回调地址"
+	},
+	"oidc.client-id": {
+		"defaultMessage": "Client ID"
+	},
+	"oidc.client-secret": {
+		"defaultMessage": "Client Secret"
+	},
+	"oidc.description": {
+		"defaultMessage": "在此配置通用 OIDC 身份服务。管理员和普通用户均在“个人资料 → 登录方式”关联自己的账号，保留原 NPM 权限及本地登录。"
+	},
+	"oidc.enabled": {
+		"defaultMessage": "启用 OIDC"
+	},
+	"oidc.issuer": {
+		"defaultMessage": "Issuer URL"
+	},
+	"oidc.last-login-method": {
+		"defaultMessage": "这是当前唯一的登录方式。请先联系管理员设置本地密码，再解除关联。"
+	},
+	"oidc.link": {
+		"defaultMessage": "关联账号"
+	},
+	"oidc.link-description": {
+		"defaultMessage": "将当前 NPM 账号关联到已配置的身份服务，使用当前登录状态，无需再次输入密码。"
+	},
+	"oidc.link-success": {
+		"defaultMessage": "OIDC 账号关联成功。"
+	},
+	"oidc.link-title": {
+		"defaultMessage": "OIDC 账号关联"
+	},
+	"oidc.linked": {
+		"defaultMessage": "当前账号已关联 OIDC 身份。"
+	},
+	"oidc.login-methods": {
+		"defaultMessage": "登录方式"
+	},
+	"oidc.not-configured": {
+		"defaultMessage": "OIDC 尚未配置或启用，请先由管理员在“设置 → OIDC 单点登录”完成配置。"
+	},
+	"oidc.public-url": {
+		"defaultMessage": "公开访问地址"
+	},
+	"oidc.saved": {
+		"defaultMessage": "OIDC 设置已保存，可在“个人资料 → 登录方式”关联账号。"
+	},
+	"oidc.secret-kept": {
+		"defaultMessage": "已配置，留空保留原密钥。"
+	},
+	"oidc.secret-new": {
+		"defaultMessage": "填写身份服务提供的密钥。"
+	},
+	"oidc.sign-in": {
+		"defaultMessage": "使用 OIDC 登录"
+	},
+	"oidc.signing-in": {
+		"defaultMessage": "正在完成 OIDC 登录…"
+	},
+	"oidc.title": {
+		"defaultMessage": "OIDC 单点登录"
+	},
+	"oidc.token-auth": {
+		"defaultMessage": "Token 端点认证方式"
+	},
+	"oidc.unlink": {
+		"defaultMessage": "解除关联"
+	},
 	"online": {
 		"defaultMessage": "在线"
 	},
diff --git a/frontend/src/modals/UserModal.tsx b/frontend/src/modals/UserModal.tsx
index 06bc38cf98..816793ed0a 100644
--- a/frontend/src/modals/UserModal.tsx
+++ b/frontend/src/modals/UserModal.tsx
@@ -4,6 +4,7 @@ import { useState } from "react";
 import { Alert } from "react-bootstrap";
 import Modal from "react-bootstrap/Modal";
 import { Button, Loading } from "src/components";
+import { LoginMethods } from "src/components/LoginMethods";
 import { useSetUser, useUser } from "src/hooks";
 import { intl, T } from "src/locale";
 import { validateEmail, validateString } from "src/modules/Validations";
@@ -22,6 +23,8 @@ const UserModal = EasyModal.create(({ id, visible, remove }: Props) => {
 	const { mutate: setUser } = useSetUser();
 	const [errorMsg, setErrorMsg] = useState<string | null>(null);
 	const [isSubmitting, setIsSubmitting] = useState(false);
+	const [section, setSection] = useState("profile");
+	const isSelf = id !== "new" && !!data && data.id === currentUser?.id;
 
 	const onSubmit = async (values: any, { setSubmitting }: any) => {
 		if (isSubmitting) return;
@@ -60,6 +63,47 @@ const UserModal = EasyModal.create(({ id, visible, remove }: Props) => {
 
 	return (
 		<Modal show={visible} onHide={remove}>
+			<Modal.Header closeButton>
+				<Modal.Title>
+					<T
+						id={isSelf ? "user.edit-profile" : id === "new" ? "object.add" : "object.edit"}
+						tData={{ object: "user" }}
+					/>
+				</Modal.Title>
+			</Modal.Header>
+			{isSelf && (
+				<div
+					className="nav nav-tabs px-3"
+					role="tablist"
+					aria-label={intl.formatMessage({ id: "user.edit-profile" })}
+				>
+					<button
+						type="button"
+						role="tab"
+						aria-selected={section === "profile"}
+						className={`nav-link${section === "profile" ? " active" : ""}`}
+						onClick={() => setSection("profile")}
+						disabled={isSubmitting}
+					>
+						<T id="user.edit-profile" />
+					</button>
+					<button
+						type="button"
+						role="tab"
+						aria-selected={section === "login"}
+						className={`nav-link${section === "login" ? " active" : ""}`}
+						onClick={() => setSection("login")}
+						disabled={isSubmitting}
+					>
+						<T id="oidc.login-methods" />
+					</button>
+				</div>
+			)}
+			{isSelf && section === "login" && (
+				<Modal.Body>
+					<LoginMethods />
+				</Modal.Body>
+			)}
 			{!isLoading && error && (
 				<Alert variant="danger" className="m-3">
 					{error?.message || "Unknown error"}
@@ -67,177 +111,183 @@ const UserModal = EasyModal.create(({ id, visible, remove }: Props) => {
 			)}
 			{(isLoading || currentIsLoading) && <Loading noLogo />}
 			{!isLoading && !currentIsLoading && data && currentUser && (
-				<Formik
-					initialValues={
-						{
-							name: data?.name,
-							nickname: data?.nickname,
-							email: data?.email,
-							isAdmin: data?.roles?.includes("admin"),
-							isDisabled: data?.isDisabled,
-						} as any
-					}
-					onSubmit={onSubmit}
-				>
-					{() => (
-						<Form>
-							<Modal.Header closeButton>
-								<Modal.Title>
-									<T id={data?.id ? "object.edit" : "object.add"} tData={{ object: "user" }} />
-								</Modal.Title>
-							</Modal.Header>
-							<Modal.Body>
-								<Alert variant="danger" show={!!errorMsg} onClose={() => setErrorMsg(null)} dismissible>
-									{errorMsg}
-								</Alert>
-								<div className="row">
-									<div className="col-lg-6">
-										<div className="mb-3">
-											<Field name="name" validate={validateString(1, 50)}>
-												{({ field, form }: any) => (
-													<div className="form-floating mb-3">
-														<input
-															id="name"
-															className={`form-control ${form.errors.name && form.touched.name ? "is-invalid" : ""}`}
-															placeholder={intl.formatMessage({ id: "user.full-name" })}
-															{...field}
-														/>
-														<label htmlFor="name">
-															<T id="user.full-name" />
-														</label>
-														{form.errors.name ? (
-															<div className="invalid-feedback">
-																{form.errors.name && form.touched.name
-																	? form.errors.name
-																	: null}
-															</div>
-														) : null}
-													</div>
-												)}
-											</Field>
+				<div hidden={isSelf && section !== "profile"}>
+					<Formik
+						initialValues={
+							{
+								name: data?.name,
+								nickname: data?.nickname,
+								email: data?.email,
+								isAdmin: data?.roles?.includes("admin"),
+								isDisabled: data?.isDisabled,
+							} as any
+						}
+						onSubmit={onSubmit}
+					>
+						{() => (
+							<Form>
+								<Modal.Body>
+									<Alert
+										variant="danger"
+										show={!!errorMsg}
+										onClose={() => setErrorMsg(null)}
+										dismissible
+									>
+										{errorMsg}
+									</Alert>
+									<div className="row">
+										<div className="col-lg-6">
+											<div className="mb-3">
+												<Field name="name" validate={validateString(1, 50)}>
+													{({ field, form }: any) => (
+														<div className="form-floating mb-3">
+															<input
+																id="name"
+																className={`form-control ${form.errors.name && form.touched.name ? "is-invalid" : ""}`}
+																placeholder={intl.formatMessage({
+																	id: "user.full-name",
+																})}
+																{...field}
+															/>
+															<label htmlFor="name">
+																<T id="user.full-name" />
+															</label>
+															{form.errors.name ? (
+																<div className="invalid-feedback">
+																	{form.errors.name && form.touched.name
+																		? form.errors.name
+																		: null}
+																</div>
+															) : null}
+														</div>
+													)}
+												</Field>
+											</div>
 										</div>
-									</div>
-									<div className="col-lg-6">
-										<div className="mb-3">
-											<Field name="nickname" validate={validateString(1, 30)}>
-												{({ field, form }: any) => (
-													<div className="form-floating mb-3">
-														<input
-															id="nickname"
-															className={`form-control ${form.errors.nickname && form.touched.nickname ? "is-invalid" : ""}`}
-															placeholder={intl.formatMessage({ id: "user.nickname" })}
-															{...field}
-														/>
-														<label htmlFor="nickname">
-															<T id="user.nickname" />
-														</label>
-														{form.errors.nickname ? (
-															<div className="invalid-feedback">
-																{form.errors.nickname && form.touched.nickname
-																	? form.errors.nickname
-																	: null}
-															</div>
-														) : null}
-													</div>
-												)}
-											</Field>
+										<div className="col-lg-6">
+											<div className="mb-3">
+												<Field name="nickname" validate={validateString(1, 30)}>
+													{({ field, form }: any) => (
+														<div className="form-floating mb-3">
+															<input
+																id="nickname"
+																className={`form-control ${form.errors.nickname && form.touched.nickname ? "is-invalid" : ""}`}
+																placeholder={intl.formatMessage({
+																	id: "user.nickname",
+																})}
+																{...field}
+															/>
+															<label htmlFor="nickname">
+																<T id="user.nickname" />
+															</label>
+															{form.errors.nickname ? (
+																<div className="invalid-feedback">
+																	{form.errors.nickname && form.touched.nickname
+																		? form.errors.nickname
+																		: null}
+																</div>
+															) : null}
+														</div>
+													)}
+												</Field>
+											</div>
 										</div>
 									</div>
-								</div>
-								<div className="mb-3">
-									<Field name="email" validate={validateEmail()}>
-										{({ field, form }: any) => (
-											<div className="form-floating mb-3">
-												<input
-													id="email"
-													type="email"
-													className={`form-control ${form.errors.email && form.touched.email ? "is-invalid" : ""}`}
-													placeholder={intl.formatMessage({ id: "email-address" })}
-													{...field}
-												/>
-												<label htmlFor="email">
-													<T id="email-address" />
-												</label>
-												{form.errors.email ? (
-													<div className="invalid-feedback">
-														{form.errors.email && form.touched.email
-															? form.errors.email
-															: null}
-													</div>
-												) : null}
-											</div>
-										)}
-									</Field>
-								</div>
-								{currentUser && data && currentUser?.id !== data?.id ? (
-									<div className="my-3">
-										<h4 className="py-2">
-											<T id="options" />
-										</h4>
-										<div className="divide-y">
-											<div>
-												<label className="row" htmlFor="isAdmin">
-													<span className="col">
-														<T id="role.admin" />
-													</span>
-													<span className="col-auto">
-														<Field name="isAdmin" type="checkbox">
-															{({ field }: any) => (
-																<label className="form-check form-check-single form-switch">
-																	<input
-																		{...field}
-																		id="isAdmin"
-																		className="form-check-input"
-																		type="checkbox"
-																	/>
-																</label>
-															)}
-														</Field>
-													</span>
-												</label>
-											</div>
-											<div>
-												<label className="row" htmlFor="isDisabled">
-													<span className="col">
-														<T id="disabled" />
-													</span>
-													<span className="col-auto">
-														<Field name="isDisabled" type="checkbox">
-															{({ field }: any) => (
-																<label className="form-check form-check-single form-switch">
-																	<input
-																		{...field}
-																		id="isDisabled"
-																		className="form-check-input"
-																		type="checkbox"
-																	/>
-																</label>
-															)}
-														</Field>
-													</span>
-												</label>
+									<div className="mb-3">
+										<Field name="email" validate={validateEmail()}>
+											{({ field, form }: any) => (
+												<div className="form-floating mb-3">
+													<input
+														id="email"
+														type="email"
+														className={`form-control ${form.errors.email && form.touched.email ? "is-invalid" : ""}`}
+														placeholder={intl.formatMessage({ id: "email-address" })}
+														{...field}
+													/>
+													<label htmlFor="email">
+														<T id="email-address" />
+													</label>
+													{form.errors.email ? (
+														<div className="invalid-feedback">
+															{form.errors.email && form.touched.email
+																? form.errors.email
+																: null}
+														</div>
+													) : null}
+												</div>
+											)}
+										</Field>
+									</div>
+									{currentUser && data && currentUser?.id !== data?.id ? (
+										<div className="my-3">
+											<h4 className="py-2">
+												<T id="options" />
+											</h4>
+											<div className="divide-y">
+												<div>
+													<label className="row" htmlFor="isAdmin">
+														<span className="col">
+															<T id="role.admin" />
+														</span>
+														<span className="col-auto">
+															<Field name="isAdmin" type="checkbox">
+																{({ field }: any) => (
+																	<label className="form-check form-check-single form-switch">
+																		<input
+																			{...field}
+																			id="isAdmin"
+																			className="form-check-input"
+																			type="checkbox"
+																		/>
+																	</label>
+																)}
+															</Field>
+														</span>
+													</label>
+												</div>
+												<div>
+													<label className="row" htmlFor="isDisabled">
+														<span className="col">
+															<T id="disabled" />
+														</span>
+														<span className="col-auto">
+															<Field name="isDisabled" type="checkbox">
+																{({ field }: any) => (
+																	<label className="form-check form-check-single form-switch">
+																		<input
+																			{...field}
+																			id="isDisabled"
+																			className="form-check-input"
+																			type="checkbox"
+																		/>
+																	</label>
+																)}
+															</Field>
+														</span>
+													</label>
+												</div>
 											</div>
 										</div>
-									</div>
-								) : null}
-							</Modal.Body>
-							<Modal.Footer>
-								<Button data-bs-dismiss="modal" onClick={remove} disabled={isSubmitting}>
-									<T id="cancel" />
-								</Button>
-								<Button
-									type="submit"
-									className="ms-auto btn-orange"
-									data-bs-dismiss="modal"
-									isLoading={isSubmitting}
-									disabled={isSubmitting}
-								>
-									<T id="save" />
-								</Button>
-							</Modal.Footer>
-						</Form>
-					)}
-				</Formik>
+									) : null}
+								</Modal.Body>
+								<Modal.Footer>
+									<Button data-bs-dismiss="modal" onClick={remove} disabled={isSubmitting}>
+										<T id="cancel" />
+									</Button>
+									<Button
+										type="submit"
+										className="ms-auto btn-orange"
+										data-bs-dismiss="modal"
+										isLoading={isSubmitting}
+										disabled={isSubmitting}
+									>
+										<T id="save" />
+									</Button>
+								</Modal.Footer>
+							</Form>
+						)}
+					</Formik>
+				</div>
 			)}
 		</Modal>
 	);
diff --git a/frontend/src/pages/Dashboard/index.tsx b/frontend/src/pages/Dashboard/index.tsx
index 5cb64867f0..214f7b8468 100644
--- a/frontend/src/pages/Dashboard/index.tsx
+++ b/frontend/src/pages/Dashboard/index.tsx
@@ -1,4 +1,5 @@
 import { IconArrowsCross, IconBolt, IconBoltOff, IconDisc } from "@tabler/icons-react";
+import { Alert } from "react-bootstrap";
 import { useNavigate } from "react-router-dom";
 import { HasPermission } from "src/components";
 import { useHostReport } from "src/hooks";
@@ -11,6 +12,11 @@ const Dashboard = () => {
 
 	return (
 		<div>
+			{new URLSearchParams(window.location.search).get("oidc") === "linked" && (
+				<Alert variant="success">
+					<T id="oidc.link-success" />
+				</Alert>
+			)}
 			<h2>
 				<T id="dashboard" />
 			</h2>
diff --git a/frontend/src/pages/Login/OIDC.test.tsx b/frontend/src/pages/Login/OIDC.test.tsx
new file mode 100644
index 0000000000..3ead19e244
--- /dev/null
+++ b/frontend/src/pages/Login/OIDC.test.tsx
@@ -0,0 +1,95 @@
+import { act, cleanup, fireEvent, render, screen, waitFor } from "@testing-library/react";
+import { StrictMode } from "react";
+import { afterEach, expect, test, vi } from "vitest";
+import Login from "./index";
+
+const oidc = vi.hoisted(() => ({ status: vi.fn(), start: vi.fn(), complete: vi.fn() }));
+vi.mock("src/api/backend/oidc", () => ({ getOIDCStatus: oidc.status, startOIDC: oidc.start }));
+vi.mock("src/context", () => ({
+	useAuthState: () => ({ completeOIDC: oidc.complete, twoFactorChallenge: null }),
+}));
+vi.mock("src/hooks", () => ({ useHealth: () => ({}) }));
+vi.mock("src/locale", () => ({
+	T: ({ id }: { id: string }) => id,
+	intl: { formatMessage: ({ id }: { id: string }) => id },
+}));
+vi.mock("src/components", () => ({
+	Button: ({ children, fullWidth, color, isLoading, ...props }: any) => <button {...props}>{children}</button>,
+	Page: ({ children }: any) => <div>{children}</div>,
+	LocalePicker: () => null,
+	ThemeSwitcher: () => null,
+}));
+
+afterEach(() => {
+	cleanup();
+	vi.resetAllMocks();
+	vi.restoreAllMocks();
+	window.history.replaceState(null, "", "/");
+});
+
+function deferred<T>() {
+	let resolve!: (value: T) => void;
+	const promise = new Promise<T>((done) => {
+		resolve = done;
+	});
+	return { promise, resolve };
+}
+
+test("a delayed status response cannot start OIDC after local login unmounts the form", async () => {
+	const status = deferred<{ enabled: boolean; autoLogin: boolean }>();
+	oidc.status.mockReturnValue(status.promise);
+	const view = render(<Login />);
+	view.unmount();
+	await act(async () => status.resolve({ enabled: true, autoLogin: true }));
+	expect(oidc.start).not.toHaveBeenCalled();
+});
+
+test("a pending OIDC start cannot redirect after local login unmounts the form", async () => {
+	const start = deferred<{ url: string }>();
+	oidc.status.mockResolvedValue({ enabled: true, autoLogin: false });
+	oidc.start.mockReturnValue(start.promise);
+	const navigate = vi.spyOn(window.location, "assign").mockImplementation(() => {});
+	const view = render(<Login />);
+	fireEvent.click(await screen.findByRole("button", { name: "oidc.sign-in" }));
+	view.unmount();
+	await act(async () => start.resolve({ url: "https://id.example/authorize" }));
+	expect(navigate).not.toHaveBeenCalled();
+});
+
+test("automatic login still starts once in Strict Mode and uses the returned authorization URL", async () => {
+	oidc.status.mockResolvedValue({ enabled: true, autoLogin: true });
+	oidc.start.mockResolvedValue({ url: "https://id.example/authorize" });
+	const navigate = vi.spyOn(window.location, "assign").mockImplementation(() => {});
+	render(
+		<StrictMode>
+			<Login />
+		</StrictMode>,
+	);
+	await waitFor(() => expect(navigate).toHaveBeenCalledWith("https://id.example/authorize"));
+	expect(oidc.start).toHaveBeenCalledTimes(1);
+});
+
+test("Strict Mode consumes the callback handoff only once", async () => {
+	window.history.replaceState(null, "", "/?oidc=complete");
+	oidc.complete.mockResolvedValue(undefined);
+	render(
+		<StrictMode>
+			<Login />
+		</StrictMode>,
+	);
+	await waitFor(() => expect(oidc.complete).toHaveBeenCalledTimes(1));
+	expect(oidc.start).not.toHaveBeenCalled();
+	expect(oidc.status).not.toHaveBeenCalled();
+});
+
+test("local recovery bypasses automatic login while keeping the OIDC button usable", async () => {
+	window.history.replaceState(null, "", "/?local=1");
+	oidc.status.mockResolvedValue({ enabled: true, autoLogin: true });
+	oidc.start.mockResolvedValue({ url: "https://id.example/authorize" });
+	const navigate = vi.spyOn(window.location, "assign").mockImplementation(() => {});
+	render(<Login />);
+	const button = await screen.findByRole("button", { name: "oidc.sign-in" });
+	expect(oidc.start).not.toHaveBeenCalled();
+	fireEvent.click(button);
+	await waitFor(() => expect(navigate).toHaveBeenCalledWith("https://id.example/authorize"));
+});
diff --git a/frontend/src/pages/Login/index.tsx b/frontend/src/pages/Login/index.tsx
index d65b2dc84d..eaeb57126f 100644
--- a/frontend/src/pages/Login/index.tsx
+++ b/frontend/src/pages/Login/index.tsx
@@ -1,6 +1,7 @@
 import { Field, Form, Formik } from "formik";
-import { useEffect, useRef, useState } from "react";
+import { useCallback, useEffect, useRef, useState } from "react";
 import Alert from "react-bootstrap/Alert";
+import { getOIDCStatus, startOIDC } from "src/api/backend/oidc";
 import { Button, LocalePicker, Page, ThemeSwitcher } from "src/components";
 import { useAuthState } from "src/context";
 import { useHealth } from "src/hooks";
@@ -8,6 +9,84 @@ import { intl, T } from "src/locale";
 import { validateEmail, validateString } from "src/modules/Validations";
 import styles from "./index.module.css";
 
+function OIDCLogin() {
+	const { completeOIDC } = useAuthState();
+	const [enabled, setEnabled] = useState(false);
+	const [busy, setBusy] = useState(false);
+	const [error, setError] = useState("");
+	const request = useRef<AbortController | null>(null);
+	const complete = useRef(completeOIDC);
+	complete.current = completeOIDC;
+	const begin = useCallback(async () => {
+		const signal = request.current?.signal;
+		if (!signal || signal.aborted) return;
+		setBusy(true);
+		setError("");
+		try {
+			const result = await startOIDC(signal);
+			if (!signal.aborted) window.location.assign(result.url);
+		} catch {
+			if (signal.aborted) return;
+			setError("OIDC login failed. Use local login or check the provider settings.");
+			setBusy(false);
+		}
+	}, []);
+	useEffect(() => {
+		const controller = new AbortController();
+		request.current = controller;
+		const { signal } = controller;
+		const query = new URLSearchParams(window.location.search);
+		if (query.get("oidc") === "complete") {
+			setBusy(true);
+			// Strict Mode replays effects before this microtask. Only the active
+			// setup may consume the one-time handoff.
+			Promise.resolve()
+				.then(() => {
+					if (!signal.aborted) return complete.current(signal);
+				})
+				.catch(() => {
+					if (signal.aborted) return;
+					setError("OIDC login failed. Try again or sign in locally.");
+					window.history.replaceState(null, "", "/?local=1");
+					getOIDCStatus(signal)
+						.then((status) => {
+							if (!signal.aborted) setEnabled(status.enabled);
+						})
+						.catch(() => {});
+				})
+				.finally(() => {
+					if (!signal.aborted) setBusy(false);
+				});
+			return () => controller.abort();
+		}
+		getOIDCStatus(signal)
+			.then((status) => {
+				if (signal.aborted) return;
+				setEnabled(status.enabled);
+				if (status.enabled && status.autoLogin && !query.has("local")) begin();
+			})
+			.catch(() => {});
+		return () => controller.abort();
+	}, [begin]);
+	return (
+		<>
+			{error && <Alert variant="danger">{error}</Alert>}
+			{enabled && (
+				<div className="mb-4">
+					<Button type="button" fullWidth color="azure" onClick={begin} disabled={busy}>
+						<T id="oidc.sign-in" />
+					</Button>
+				</div>
+			)}
+			{busy && (
+				<p className="text-secondary">
+					<T id="oidc.signing-in" />
+				</p>
+			)}
+		</>
+	);
+}
+
 function TwoFactorForm() {
 	const codeRef = useRef<HTMLInputElement>(null);
 	const [formErr, setFormErr] = useState("");
@@ -103,6 +182,7 @@ function LoginForm() {
 			<h2 className="h2 text-center mb-4">
 				<T id="login.title" />
 			</h2>
+			<OIDCLogin />
 			{formErr !== "" && <Alert variant="danger">{formErr}</Alert>}
 			<Formik
 				initialValues={
diff --git a/frontend/src/pages/Settings/Layout.tsx b/frontend/src/pages/Settings/Layout.tsx
index a0a77db29e..fd615ed0da 100644
--- a/frontend/src/pages/Settings/Layout.tsx
+++ b/frontend/src/pages/Settings/Layout.tsx
@@ -1,7 +1,12 @@
+import { useState } from "react";
 import { T } from "src/locale";
 import DefaultSite from "./DefaultSite";
+import OIDC from "./OIDC";
 
 export default function Layout() {
+	const [section, setSection] = useState(
+		new URLSearchParams(window.location.search).has("oidc") ? "oidc" : "default",
+	);
 	// Taken from https://preview.tabler.io/settings.html
 	// Refer to that when updating this content
 
@@ -22,16 +27,35 @@ export default function Layout() {
 							<div className="list-group list-group-transparent">
 								<a
 									href="#"
-									className="list-group-item list-group-item-action d-flex align-items-center active"
-									onClick={(e) => e.preventDefault()}
+									className={
+										"list-group-item list-group-item-action d-flex align-items-center" +
+										(section === "default" ? " active" : "")
+									}
+									onClick={(e) => {
+										e.preventDefault();
+										setSection("default");
+									}}
 								>
 									<T id="settings.default-site" />
 								</a>
+								<a
+									href="?oidc"
+									className={
+										"list-group-item list-group-item-action d-flex align-items-center" +
+										(section === "oidc" ? " active" : "")
+									}
+									onClick={(e) => {
+										e.preventDefault();
+										setSection("oidc");
+									}}
+								>
+									<T id="oidc.title" />
+								</a>
 							</div>
 						</div>
 					</div>
 					<div className="col-12 col-md-9 d-flex flex-column">
-						<DefaultSite />
+						{section === "oidc" ? <OIDC /> : <DefaultSite />}
 					</div>
 				</div>
 			</div>
diff --git a/frontend/src/pages/Settings/OIDC.test.tsx b/frontend/src/pages/Settings/OIDC.test.tsx
new file mode 100644
index 0000000000..013849fa16
--- /dev/null
+++ b/frontend/src/pages/Settings/OIDC.test.tsx
@@ -0,0 +1,52 @@
+import { fireEvent, render, screen, waitFor } from "@testing-library/react";
+import "@testing-library/jest-dom/vitest";
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import OIDC from "./OIDC";
+
+const request = vi.hoisted(() => vi.fn());
+vi.mock("src/api/backend/oidc", () => ({ oidcRequest: request }));
+vi.mock("src/locale", () => ({
+	T: ({ id }: { id: string }) => id,
+	intl: { formatMessage: ({ id }: { id: string }) => id },
+}));
+vi.mock("src/components", () => ({
+	Loading: () => null,
+	Button: ({ children, isLoading, actionType, ...props }: any) => <button {...props}>{children}</button>,
+}));
+const config = {
+	enabled: true,
+	autoLogin: false,
+	issuer: "https://id.example",
+	publicUrl: "https://npm.example",
+	clientId: "client",
+	clientSecretConfigured: true,
+	scopes: "openid",
+	revision: "r1",
+	callbackUrl: "https://npm.example/api/oidc/callback",
+	tokenAuthMethod: "auto",
+};
+describe("OIDC settings", () => {
+	beforeEach(() => request.mockReset());
+	it("keeps secrets blank and locks the dedicated form until a delayed save completes", async () => {
+		let finish: (v: unknown) => void = () => {};
+		request.mockResolvedValueOnce(config).mockImplementationOnce(
+			() =>
+				new Promise((resolve) => {
+					finish = resolve;
+				}),
+		);
+		render(<OIDC />);
+		const issuer = await screen.findByLabelText("oidc.issuer");
+		expect(screen.getByLabelText("oidc.client-secret")).toHaveValue("");
+		fireEvent.change(issuer, { target: { value: "https://new.example" } });
+		fireEvent.click(screen.getByRole("button", { name: "save" }));
+		await waitFor(() => expect(issuer).toBeDisabled());
+		expect(screen.getByLabelText("oidc.client-secret")).toBeDisabled();
+		expect(request.mock.calls[1][0]).toBe("settings");
+		expect(request.mock.calls[1][1]).toBe("PUT");
+		expect(request.mock.calls[1][2].clientSecret).toBe("");
+		finish({ ...config, issuer: "https://new.example", revision: "r2" });
+		await waitFor(() => expect(issuer).not.toBeDisabled());
+		expect(await screen.findByText("oidc.saved")).toBeVisible();
+	});
+});
diff --git a/frontend/src/pages/Settings/OIDC.tsx b/frontend/src/pages/Settings/OIDC.tsx
new file mode 100644
index 0000000000..2d3651daa6
--- /dev/null
+++ b/frontend/src/pages/Settings/OIDC.tsx
@@ -0,0 +1,148 @@
+import { Field, Form, Formik } from "formik";
+import { useEffect, useState } from "react";
+import { Alert } from "react-bootstrap";
+import { type OIDCSettings, oidcRequest } from "src/api/backend/oidc";
+import { Button, Loading } from "src/components";
+import { intl, T } from "src/locale";
+
+export default function OIDC() {
+	const [data, setData] = useState<OIDCSettings>();
+	const [error, setError] = useState("");
+	const [saved, setSaved] = useState(false);
+	useEffect(() => {
+		oidcRequest<OIDCSettings>("settings")
+			.then((v) => setData({ ...v, clientSecret: "", publicUrl: v.publicUrl || window.location.origin }))
+			.catch((e) => setError(e.message));
+	}, []);
+	if (!data)
+		return <div className="card-body">{error ? <Alert variant="danger">{error}</Alert> : <Loading noLogo />}</div>;
+	return (
+		<Formik
+			initialValues={data}
+			enableReinitialize
+			onSubmit={async (values, { setSubmitting }) => {
+				setError("");
+				setSaved(false);
+				try {
+					const result = await oidcRequest<OIDCSettings>("settings", "PUT", values);
+					setData({ ...result, clientSecret: "" });
+					setSaved(true);
+				} catch (e) {
+					setError((e as Error).message);
+				} finally {
+					setSubmitting(false);
+				}
+			}}
+		>
+			{({ isSubmitting, values }) => (
+				<Form>
+					<div className="card-body">
+						<h3 className="card-title">
+							<T id="oidc.title" />
+						</h3>
+						<p className="text-secondary">
+							<T id="oidc.description" />
+						</p>
+						{error && <Alert variant="danger">{error}</Alert>}
+						{saved && (
+							<Alert variant="success">
+								<T id="oidc.saved" />
+							</Alert>
+						)}
+						<fieldset disabled={isSubmitting}>
+							<label className="form-check mb-3" htmlFor="oidc-enabled">
+								<Field id="oidc-enabled" type="checkbox" name="enabled" className="form-check-input" />
+								<span className="form-check-label">
+									<T id="oidc.enabled" />
+								</span>
+							</label>
+							{(
+								[
+									["issuer", "oidc.issuer", "url"],
+									["clientId", "oidc.client-id", "text"],
+									["clientSecret", "oidc.client-secret", "password"],
+									["publicUrl", "oidc.public-url", "url"],
+								] as const
+							).map(([name, label, type]) => (
+								<div className="mb-3" key={name}>
+									<label className="form-label" htmlFor={name}>
+										<T id={label} />
+									</label>
+									<Field
+										id={name}
+										type={type}
+										name={name}
+										className="form-control"
+										autoComplete={type === "password" ? "new-password" : "off"}
+										required={values.enabled && name !== "clientSecret"}
+									/>
+									{name === "clientSecret" && (
+										<small className="form-hint">
+											<T
+												id={
+													data.clientSecretConfigured ? "oidc.secret-kept" : "oidc.secret-new"
+												}
+											/>
+										</small>
+									)}
+								</div>
+							))}
+							<div className="mb-3">
+								<div className="form-label">
+									<T id="oidc.callback" />
+								</div>
+								<code>{values.publicUrl.replace(/\/$/, "")}/api/oidc/callback</code>
+							</div>
+							<details className="mb-3">
+								<summary className="text-secondary">
+									<T id="oidc.advanced" />
+								</summary>
+								<label className="form-label mt-3" htmlFor="scopes">
+									Scopes
+								</label>
+								<Field id="scopes" name="scopes" className="form-control mb-3" />
+								<label className="form-label" htmlFor="tokenAuthMethod">
+									<T id="oidc.token-auth" />
+								</label>
+								<Field
+									as="select"
+									id="tokenAuthMethod"
+									name="tokenAuthMethod"
+									className="form-select mb-3"
+								>
+									<option value="auto">Auto</option>
+									<option value="client_secret_basic">client_secret_basic</option>
+									<option value="client_secret_post">client_secret_post</option>
+								</Field>
+								<label className="form-check" htmlFor="oidc-auto-login">
+									<Field
+										id="oidc-auto-login"
+										type="checkbox"
+										name="autoLogin"
+										className="form-check-input"
+									/>
+									<span className="form-check-label">
+										<T id="oidc.auto-login" />
+									</span>
+								</label>
+							</details>
+						</fieldset>
+					</div>
+					<div className="card-footer bg-transparent">
+						<div className="btn-list justify-content-end">
+							<Button
+								type="submit"
+								className="bg-teal"
+								actionType="primary"
+								disabled={isSubmitting}
+								isLoading={isSubmitting}
+							>
+								{intl.formatMessage({ id: "save" })}
+							</Button>
+						</div>
+					</div>
+				</Form>
+			)}
+		</Formik>
+	);
+}