add

deploy/config.example.yaml

@@ -198,12 +198,18 @@ api:
   trusted_proxies: []
   cors_origins: []
   auth:
-    # none | apikey | basic
+    # none | apikey | basic | oidc
     mode: apikey
     api_keys: ["CHANGE-ME-long-random-string"]
     read_only_api_keys: []
     trust_loopback: true
     session_ttl: 12h
+    # For mode: oidc, configure a registered public PKCE client and the API
+    # audience included in its access tokens. Users need the admin role to write.
+    oidc_issuer: https://users.k6n.net
+    oidc_audience: https://fancy-dns.example.net
+    oidc_client_id: fancy-dns
+    oidc_write_roles: [admin]
   rate_limit:
     per_minute: 600
     failures: 10