Troubleshooting and support

Who this is for

Developers diagnosing protocol-level failures and IT administrators resolving configuration issues - the decision flow below routes both. If an end user of your application is stuck, point them to the LuxID user help instead of these pages.

Hit a wall? start here

Most LuxID integration problems fall into one of a handful of categories. Use the decision flow below to reach the right page in under a minute, then come back here if you need a broader view.

If you are not sure which branch applies, start with Common errors. It covers the ten mistakes that account for the majority of integration support requests.

What is in this section

Page	When to use it
Common errors	The ten most frequent integration mistakes, each with the exact error response, the root cause, and the fix
OAuth and OIDC error codes	Full reference catalogue of every error code LuxID may return, per RFC 6749, OIDC Core, and RFC 6750
Token validation issues	ID token and JWT validation failures: signature, issuer, audience, expiry, nonce, algorithm confusion
Redirect and domain issues	Why redirect URIs are exact-match-only, the five most common mismatch patterns, and mobile deep links
FAQ	Thirty-plus Q&As on onboarding, protocols, tokens, claims, MFA, compliance, and operations
Diagnose a failing request	Decision tree for integration errors, capturing the right on-screen identifier, and raising a ticket
Contact and support channels	How to reach the LuxID support team, what to include in a ticket, and response SLA tiers
Error reference	One-table lookup of every OAuth/OIDC and platform error: HTTP status, where it surfaces, cause, whether to retry, and the fix
Identifiers reference	The four LuxID diagnostic identifiers - Error ID, Transaction ID, Support ID, Global Transaction ID - and which one to ask a user for

Before you file a ticket

Work through this checklist first. These steps resolve the majority of issues without waiting for a support response.

1. Work through the diagnostic decision tree. Rule out an environment or Client ID mismatch before raising a ticket. See Diagnose a failing request.

2. Confirm your environment. UAT and production use separate Client IDs, client secrets, endpoints, and user accounts. Mixing them is one of the most common causes of invalid_client errors. UAT base URL: https://login-uat.luxid.lu.

3. Inspect the error response. OAuth errors arrive as query parameters on the redirect (?error=...&error_description=...) or as a JSON body from the token endpoint. Copy the exact error and error_description values before searching or escalating.

4. Capture the on-screen identifier. A failed sign-in ("Connection error with LuxID" dialog) shows an Error ID and a long-hex Transaction ID; a request blocked or masked at LuxID's edge shows a Support ID. Quote whichever the user saw so the support team can locate the corresponding logs. LuxID also carries a Global Transaction ID in the HTTP response headers (invisible on screen, captured by your own code). The identifiers reference explains which is which; see also Contact and support channels.

5. Check your JWKS cache. If tokens are failing signature validation, verify that your application refreshed its JWKS after a key rotation. JWKS URL: https://login.luxid.lu/mga/sps/oauth/oauth20/jwks/OIDC-LUXID. See Token validation issues.

6. Validate your redirect URI. LuxID enforces exact-match redirect URIs. A single trailing slash or a scheme difference (http vs https) causes a mismatch. See Redirect and domain issues.

7. Review the audit log (once available). The LuxID Console Logs view will show every authentication event for your application, including the failure reason. See Logs and audit trails.

8. Read the discovery document. The discovery document at https://login.luxid.lu/.well-known/openid-configuration is the source for the core endpoint URLs, supported scopes, and signing algorithms. Note that it also advertises some endpoints and capabilities that are not enabled for Partner use (token introspection, dynamic client registration, the device endpoints, mTLS client-auth methods), so do not assume everything listed is available - confirm with LuxID.

Related sections

• Add login to your Application - start here for new integrations
• OpenID Connect - full OIDC flow reference
• Protect your Application - security baseline checklist
• Session management - token lifetimes, refresh token rotation, logout
• Key management - JWKS rotation and caching strategy
• Redirect URIs and domains - Console configuration reference
• Logs and audit trails - searching authentication events
• Token debugger - decode and validate tokens interactively
• SLA and support - response time commitments by support tier