Register an identity provider for a verified domain
Registers an identity provider for one verified domain. google needs only the credentials and pins the login
to that Google Workspace domain; oidc is the fallback for any other provider and discovers its endpoints from
the issuer’s /.well-known/openid-configuration. The domain must already be verified, and registering does not
redirect anyone on its own: that is enabled separately.
Authorizations
The access token received from the authorization server in the OAuth 2.0 flow.
Path Parameters
Unique identifier for a specific organization
[a-zA-Z0-9_-~:]+Body
Request payload for registering an identity provider for a verified domain
Which identity provider this is. google pins the login to a Google Workspace domain and microsoft to a single Entra tenant, taken from the issuer; oidc is the fallback for anything else that speaks OpenID Connect.
google, microsoft, oidc The verified email domain this provider will serve.
OAuth client ID the organization registered with the provider
OAuth client secret. Write-only: it is stored in Keycloak and is never returned by this API.
OIDC issuer URL. Required for oidc, and for microsoft where it names the Entra tenant; ignored for google. Must be https, and must serve a /.well-known/openid-configuration document naming itself as the issuer.
Response
Identity provider registered
An identity provider serving one of the organization's verified domains. The client secret is write-only and is never returned.
Stable identifier for this provider, used in its own endpoints.
Which identity provider this is. google pins the login to a Google Workspace domain and microsoft to a single Entra tenant, taken from the issuer; oidc is the fallback for anything else that speaks OpenID Connect.
google, microsoft, oidc Name members see for this provider when signing in.
The verified email domain this provider serves.
Whether members on this domain are sent to this provider automatically, leaving no other way in. Registering a provider does not set this; it is enabled separately once a sign-in through it has worked.
OAuth client ID the organization registered with the provider.
OIDC issuer URL, without the /.well-known suffix.