v18

latestOpenAPI 3.0.0raw.githubusercontent.com2026-08-014211,6201.8 MB

gitpod.v1.OrganizationService

CreateSSOConfiguration

Creates or updates SSO configuration for organizational authentication.

Use this method to:

Configure OIDC-based SSO providers
Set up built-in providers (Google, GitHub, etc.)
Define custom identity providers
Manage authentication policies

Examples

Configure built-in Google SSO:

Sets up SSO using Google Workspace.

organizationId: "b0e12f6c-4c67-429d-a4a6-d9838b5da047"
clientId: "012345678-abcdefghijklmnopqrstuvwxyz.apps.googleusercontent.com"
clientSecret: "GOCSPX-abcdefghijklmnopqrstuvwxyz123456"
issuerUrl: "https://accounts.google.com"
emailDomain: "acme-corp.com"

Configure custom OIDC provider:

Sets up SSO with a custom identity provider.

organizationId: "b0e12f6c-4c67-429d-a4a6-d9838b5da047"
clientId: "acme-corp-gitpod"
clientSecret: "secret-token-value"
issuerUrl: "https://sso.acme-corp.com"
emailDomain: "acme-corp.com"

post/gitpod.v1.OrganizationService/CreateSSOConfiguration

Request body

additionalScopesstring[]

additional_scopes are extra OIDC scopes to request from the identity provider during sign-in. These are appended to the default scopes (openid, email, profile).

claimsExpressionstring nullable

claims_expression is an optional CEL expression evaluated against OIDC token claims during login. When set, the expression must evaluate to true for the login to succeed. Example: claims.email_verified && claims.email.endsWith("@example.com")

clientIdstring required

client_id is the client ID of the OIDC application set on the IdP

clientSecretstring required

client_secret is the client secret of the OIDC application set on the IdP

displayNamestring

emailDomainstring nullable

email_domain is the domain that is allowed to sign in to the organization

emailDomainsstring[]

issuerUrlstring uri required

issuer_url is the URL of the IdP issuer

organizationIdstring uuid required

Response

Success