Stores

Stores in IdentityServer are the persistence layer abstractions responsible for managing various types of data needed for the authentication and authorization processes. They provide interfaces to store and retrieve configuration and operational data. All store interfaces live in the Duende.IdentityServer.Stores namespace.

Configuration Stores

Configuration stores manage the relatively static data that defines how IdentityServer behaves:

Store	Purpose
IClientStore	Client application registrations
IResourceStore	API resources, API scopes, and identity resources
IIdentityProviderStore	Dynamic external identity providers
ICorsPolicyService	CORS origin validation for clients
`IConnectedApplicationStore`	Read-only unified access to all registered applications across protocols (OIDC clients and SAML service providers)
ISamlServiceProviderStore	SAML Service Provider configuration retrieval by entity ID (used when SAML is enabled)

Operational Stores

Operational stores manage transient, runtime data that supports active authentication flows. Several higher-level interfaces (IAuthorizationCodeStore, IRefreshTokenStore, IReferenceTokenStore, IUserConsentStore) are backed by IPersistedGrantStore by default. Replacing IPersistedGrantStore is usually sufficient, but each can be replaced individually for finer-grained control.

Store	Purpose
IPersistedGrantStore	Authorization codes, refresh tokens, reference tokens, and user consent (the primary operational store)
`IAuthorizationCodeStore`	Authorization codes issued during the Authorization Code flow (backed by `IPersistedGrantStore` by default)
`IRefreshTokenStore`	Refresh tokens, including rotation/update semantics (backed by `IPersistedGrantStore` by default)
`IReferenceTokenStore`	Reference tokens used when clients receive opaque handles instead of JWTs (backed by `IPersistedGrantStore` by default)
`IUserConsentStore`	Remembered user consent decisions per subject/client pair (backed by `IPersistedGrantStore` by default)
IDeviceFlowStore	Device authorization grant data
IBackChannelAuthenticationRequestStore	CIBA authentication requests
IPushedAuthorizationRequestStore	Pushed Authorization Requests (PAR)
IServerSideSessionStore	Server-side user sessions
ISigningKeyStore	Automatic key management signing keys

Key Management Stores

These stores provide signing and validation keys to the runtime:

Store	Purpose
`ISigningCredentialStore`	Provides the active signing credential for token signing
`IValidationKeysStore`	Provides all public keys for token validation (published via JWKS)

In-Memory Implementations

IdentityServer provides default in-memory implementations suitable for development and testing. These are registered via the DI extension methods:

builder.Services.AddIdentityServer()
    .AddInMemoryClients(Config.Clients)
    .AddInMemoryApiScopes(Config.ApiScopes)
    .AddInMemoryIdentityResources(Config.IdentityResources);

For production environments, use the Entity Framework Core integration or implement custom stores using your preferred database technology.