Supervised worker that fetches and caches OpenFeed's OIDC metadata and JWKS.

Add it to your supervision tree, above anything that talks to OpenFeed:

children = [
  {OpenFeed.ProviderConfiguration, openfeed_config},
  MyApp.Repo,
  MyAppWeb.Endpoint
]

Discovery then happens once at boot and refreshes on expiry, rather than on every call. OpenFeed.Auth looks the worker up by config.provider_name, so running more than one — one per tenant registration, say — just means giving each config a distinct :provider_name.

The introspection metadata override

OpenFeed's discovery document deliberately omits introspection_endpoint_auth_methods_supported. That is not an oversight to wait out: the auth server strips the field on purpose, so as to advertise only capabilities it actually implements.

oidcc reads the omission strictly and refuses to authenticate at the introspection endpoint with :no_supported_auth_method. In practice the introspection endpoint accepts exactly the same client authentication as the token endpoint, so this worker injects that metadata via oidcc's document_overrides quirk.

Baking it in here is the point — it is a permanent property of OpenFeed, and nobody using this library should have to rediscover it.

Startup and failure

The worker retries with backoff if OpenFeed is unreachable at boot, so a transient outage does not stop your application from starting. Calls made before the first successful fetch will fail; if you need to gate on readiness, use ready?/1.