Skip to main content

Deprecated: Add OIDC Identity Provider (IDP)​

deprecated

This endpoint has been deprecated and may be removed in future versions of the API.

Create a new identity provider configuration on the organization to enable your users to log in with social/enterprise login. The provider has to be OIDC-compliant. This configuration can only be used by the organization itself.

Header Parameters
    x-zitadel-orgid string

    The default is always the organization of the requesting user. If you like to get/set a result of another organization include the header. Make sure the user has permission to access the requested data.

Request Body required
    name string required

    Possible values: non-empty and <= 200 characters

    stylingType string

    Possible values: [STYLING_TYPE_UNSPECIFIED, STYLING_TYPE_GOOGLE]

    Default value: STYLING_TYPE_UNSPECIFIED

    some identity providers specify the styling of the button to their login

    clientId string required

    Possible values: non-empty and <= 200 characters

    client id generated by the identity provider

    clientSecret string required

    Possible values: non-empty and <= 200 characters

    client secret generated by the identity provider

    issuer string required

    the OIDC issuer of the identity provider

    scopes string[]

    the scopes requested by ZITADEL during the request on the identity provider

    displayNameMapping string

    Possible values: [OIDC_MAPPING_FIELD_UNSPECIFIED, OIDC_MAPPING_FIELD_PREFERRED_USERNAME, OIDC_MAPPING_FIELD_EMAIL]

    Default value: OIDC_MAPPING_FIELD_UNSPECIFIED

    definition which field is mapped to the display name of the user

    usernameMapping string

    Possible values: [OIDC_MAPPING_FIELD_UNSPECIFIED, OIDC_MAPPING_FIELD_PREFERRED_USERNAME, OIDC_MAPPING_FIELD_EMAIL]

    Default value: OIDC_MAPPING_FIELD_UNSPECIFIED

    definition which field is mapped to the email of the user

    autoRegister boolean
Responses

A successful response.

Schema
    details object
    sequence uint64

    on read: the sequence of the last event reduced by the projection

    on manipulation: the timestamp of the event(s) added by the manipulation

    creationDate date-time

    on read: the timestamp of the first event of the object

    on create: the timestamp of the event(s) added by the manipulation

    changeDate date-time

    on read: the timestamp of the last event reduced by the projection

    on manipulation: the

    resourceOwner resource_owner is the organization an object belongs to
    idpId string
POST /idps/oidc

Authorization

name: OAuth2type: oauth2scopes: openid,urn:zitadel:iam:org:project:id:zitadel:audflows: {
  "authorizationCode": {
    "authorizationUrl": "$CUSTOM-DOMAIN/oauth/v2/authorize",
    "tokenUrl": "$CUSTOM-DOMAIN/oauth/v2/token",
    "scopes": {
      "openid": "openid",
      "urn:zitadel:iam:org:project:id:zitadel:aud": "urn:zitadel:iam:org:project:id:zitadel:aud"
    }
  }
}

Request

Base URL
https://$CUSTOM-DOMAIN/management/v1
Bearer Token
x-zitadel-orgid — header
Content-Type
Body required
{

  "name": "google",

  "stylingType": "STYLING_TYPE_UNSPECIFIED",

  "clientId": "string",

  "clientSecret": "string",

  "issuer": "https://accounts.google.com",

  "scopes": [

    "openid",

    "profile",

    "email"

  ],

  "displayNameMapping": "OIDC_MAPPING_FIELD_UNSPECIFIED",

  "usernameMapping": "OIDC_MAPPING_FIELD_UNSPECIFIED",

  "autoRegister": true

}
Accept
curl / cURL
curl -L -X POST 'https://$CUSTOM-DOMAIN/management/v1/idps/oidc' \
-H 'Content-Type: application/json' \
-H 'Accept: application/json' \
-H 'Authorization: Bearer <TOKEN>' \
--data-raw '{
  "name": "google",
  "stylingType": "STYLING_TYPE_UNSPECIFIED",
  "clientId": "string",
  "clientSecret": "string",
  "issuer": "https://accounts.google.com",
  "scopes": [
    "openid",
    "profile",
    "email"
  ],
  "displayNameMapping": "OIDC_MAPPING_FIELD_UNSPECIFIED",
  "usernameMapping": "OIDC_MAPPING_FIELD_UNSPECIFIED",
  "autoRegister": true
}'