redb.Identity has added a gRPC facade to its OpenID server, placing it alongside the existing HTTP transport on the same core routes. The server remains transport-agnostic: all authorization logic resides behind direct-vm://identity-* addresses, and both HTTP and gRPC now act as interchangeable facades over this kernel.
The new surface implements the protocol operations required by relying parties: Token at /identity.v1.Identity/Token (RFC 6749 §3.2), Introspect (RFC 7662), Revoke (RFC 7009), UserInfo (OIDC Core §5.3), Discovery, and Jwks (RFC 7517). A gRPC health check is also exposed via grpc.health.v1.Health/Check. Forty administrative operations across five services (Users, Applications, Groups, Scopes, Tokens) are available on a dedicated management port.
Requests accept the same key-value pairs defined by the RFCs plus a map<string, string> for extensions. Responses type the fields fixed by the specifications and place open sets such as claims into google.protobuf.Struct. OAuth errors are returned as gRPC status codes (UNAUTHENTICATED, PERMISSION_DENIED, RESOURCE_EXHAUSTED, INVALID_ARGUMENT) with the original error code and correlation identifier carried in trailers.
The same token issued through dynamic client registration over HTTP is accepted by the gRPC endpoint and yields identical authorization decisions. Scope evaluation occurs once inside the kernel at direct-vm://identity-authz-check, eliminating the risk of divergent policy between transports.
Browser flows (authorize, login, consent, MFA), DPoP proofs (RFC 9449), and user self-service remain exclusively on HTTP. The gRPC listener uses its own port because it requires HTTP/2 while the HTTP facade supports both HTTP/1.1 and HTTP/2.
Configuration is placed in the shared context.json under the identity.grpc section, allowing independent host, port, TLS, and compression settings. The EmitHttpCompatHeaders flag is enabled by default to preserve IP-based rate limiting and device metadata collection.


