oidc-echo placeholder (protected by OIDC)