Skip to main content
POST
Register an identity provider for a verified domain

Authorizations

Authorization
string
header
required

The access token received from the authorization server in the OAuth 2.0 flow.

Path Parameters

organizationID
string
required

Unique identifier for a specific organization

Pattern: [a-zA-Z0-9_-~:]+

Body

application/json

Request payload for registering an identity provider for a verified domain

type
enum<string>
required

Which identity provider this is. google pins the login to a Google Workspace domain and microsoft to a single Entra tenant, taken from the issuer; oidc is the fallback for anything else that speaks OpenID Connect.

Available options:
google,
microsoft,
oidc
domain
string
required

The verified email domain this provider will serve.

client_id
string
required

OAuth client ID the organization registered with the provider

client_secret
string
required

OAuth client secret. Write-only: it is stored in Keycloak and is never returned by this API.

issuer
string<uri>

OIDC issuer URL. Required for oidc, and for microsoft where it names the Entra tenant; ignored for google. Must be https, and must serve a /.well-known/openid-configuration document naming itself as the issuer.

Response

Identity provider registered

An identity provider serving one of the organization's verified domains. The client secret is write-only and is never returned.

alias
string
required

Stable identifier for this provider, used in its own endpoints.

type
enum<string>
required

Which identity provider this is. google pins the login to a Google Workspace domain and microsoft to a single Entra tenant, taken from the issuer; oidc is the fallback for anything else that speaks OpenID Connect.

Available options:
google,
microsoft,
oidc
display_name
string
required

Name members see for this provider when signing in.

domain
string
required

The verified email domain this provider serves.

enforced
boolean
required

Whether members on this domain are sent to this provider automatically, leaving no other way in. Registering a provider does not set this; it is enabled separately once a sign-in through it has worked.

client_id
string
required

OAuth client ID the organization registered with the provider.

issuer
string<uri>

OIDC issuer URL, without the /.well-known suffix.