add

README.md

@@ -316,9 +316,11 @@ file.
 | `api.allow_blocklist_write` | bool | `true` | **unused** |
 | `api.trusted_proxies` | list of CIDR | empty | the only peers whose `X-Forwarded-For` / `X-Real-IP` is believed |
 | `api.cors_origins` | list | empty | `"*"` is allowed but discouraged; the origin is echoed per request so credentials keep working |
-| `api.auth.mode` | `none` \| `apikey` \| `basic` | `apikey` | see [Admin API](#admin-api) |
+| `api.auth.mode` | `none` \| `apikey` \| `basic` \| `oidc` | `apikey` | see [Admin API](#admin-api) |
 | `api.auth.api_keys` | list | empty | full-access keys (`X-API-Key` header, or basic auth with any user) |
 | `api.auth.read_only_api_keys` | list | empty | GET-only keys; mutations answer 403 |
+| `api.auth.oidc_issuer` / `oidc_audience` / `oidc_client_id` | strings | empty | OIDC issuer, accepted access-token audience, and public browser client id; required in `oidc` mode |
+| `api.auth.oidc_write_roles` | list | `[admin]` | OIDC roles allowed to make changes; other authenticated users are read-only |
 | `api.auth.username` / `password` | string | — | for `mode: basic`; the password may be plaintext or a bcrypt hash (it is hashed either way and compared in constant time) |
 | `api.auth.session_ttl` | duration | `12h` | lifetime of a `POST /api/auth/login` bearer token |
 | `api.auth.trust_loopback` | bool | `true` | requests from `127.0.0.0/8` and `::1` authenticate as a local principal without a key |
@@ -520,6 +522,18 @@ hash in constant time. `basic`: HTTP basic against `auth.username` /
 mutation are open to anyone who can reach the port; the settings validator
 emits a warning for exactly this.
 
+`oidc` mode signs the console in through a public PKCE client. Configure
+`oidc_issuer` (for go-auth, `https://users.k6n.net`), `oidc_client_id`, and
+`oidc_audience` (the resource audience included in the client's access tokens).
+Register `https://<fancy-dns-host>/auth/oidc/callback` as a redirect URI, and
+include the configured audience in the client's `audience` list. The API
+validates RS256 signatures and issuer, audience and expiry using OIDC discovery
+and JWKS. Users carrying a role listed in `oidc_write_roles` (default `admin`)
+can make changes; other valid users have read-only access. Discovery metadata
+is fetched lazily on the first bearer-token request. Set `trust_loopback: false`
+on networked deployments if local requests should also require an OIDC token;
+the loopback bypass is independent of the selected auth mode.
+
 JSON request bodies are capped at 4 MiB and unknown fields are rejected, so a
 typo is a 400 rather than a silent no-op. A panic in a handler becomes a 500
 and is logged.