Five minutes is a promise, so here is the clock.
Minute one: install the plugin
Copy the Authfu plugin into wp-content/plugins/authfu and activate it. There are no dependencies to fetch. It speaks OpenID Connect with PKCE using the HTTP and cryptography tools WordPress already has, so activation is the whole install.
Minute two: create the app in Authfu
In the Authfu console, add a WordPress app and give it your site’s callback URL: https://your-site.example/wp-login.php?authfu=callback. Authfu produces a Setup Key, a single string that carries the issuer, client id, and client secret together.
Minute three: paste the key
In WordPress, open Settings → Authfu, paste the Setup Key, and save. WordPress unpacks it and stores the pieces; the secret is never rendered back into the page. Click Test connection and watch discovery succeed. That is the entire configuration.
Minute four: decide who gets what
Choose a default role for people who arrive without one, and decide whether the login page should send everyone straight to Authfu or keep the familiar form alongside the Authfu button.
Then look at roles. Authfu sends a roles claim with each sign-in, and the plugin maps administrator, editor, author, contributor, and subscriber one-to-one. Assign roles in Authfu, and they are applied the next time each person signs in. A role change in Authfu is a role change in WordPress, with no second admin screen to keep in step.
Minute five: sign in
Open wp-login.php, choose Continue with Authfu, and go. If your account has two-factor authentication, you will enter your code first, then receive the link. Open it and you are in, with the role Authfu assigned. Existing WordPress accounts link on first sign-in by email, and from then on they are matched by Authfu’s stable subject id, which is the safer key.
While the clock is still running
Copy the back-channel logout URL from the settings page into your Authfu app. That makes revocation immediate rather than eventual. And click Sync users now so the people already on your site show up in Authfu with the roles they hold today.
That is the walkthrough. Five minutes, one key, and a login page where the password field is optional.