---
title: "Create an AI Gateway Identity Provider"
method: POST
path: "/v1/ai-gateways/{gatewayId}/identity"
tags: ["AI Gateway Identity Providers"]
---

# Create an AI Gateway Identity Provider

`POST /v1/ai-gateways/{gatewayId}/identity`

**Pre-release Endpoint**
This endpoint is currently in beta and is subject to change.

Registers a new identity provider for the AI Gateway.

## Request body

- union — **Pre-release Feature** This feature is currently in beta and is subject to change.
  - AIGatewayIdentityProviderKeyAuth — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration for an identity provider.
    - `display_name` string, required — The display name for this identity provider instance.
    - `name` string, required — Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID.
    - `labels` PublicLabels — Public labels store information about an entity that can be used for filtering a list of objects. Public labels are intended to store **PUBLIC** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
    - `managed_by` ManagedBy — Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character.
    - `type` 'key-auth', required
    - `config` object — Configuration for the Kong Key auth identity provider. For advanced use cases, additional config properties can be sent in the request body. See: https://developer.konghq.com/plugins/key-auth/reference/ for the list of properties
      - `hide_credentials` boolean — An optional boolean value telling the plugin to show or hide the credential from the upstream service. If true, the plugin strips the credential from the request.
      - `key_in_body` boolean — If enabled, reads the request body. Supported MIME types: application/www-form-urlencoded, application/json, and multipart/form-data.
      - `key_in_header` boolean — If enabled (default), the plugin reads the request header and tries to find the key in it.
      - `key_in_query` boolean — If enabled (default), the plugin reads the query parameter in the request and tries to find the key in it.
      - `key_names` string[] — An array of strings containing the names of the keys to look for in the request.
  - AIGatewayIdentityProviderOpenIDConnect — **Pre-release Feature** This feature is currently in beta and is subject to change. Configuration for an identity provider.
    - `display_name` string, required — The display name for this identity provider instance.
    - `name` string, required — Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID.
    - `labels` PublicLabels — Public labels store information about an entity that can be used for filtering a list of objects. Public labels are intended to store **PUBLIC** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
    - `managed_by` ManagedBy — Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character.
    - `type` 'openid-connect', required
    - `config` object — Configuration for the OpenID Connect identity provider. For advanced use cases, additional config properties can be sent in the request body. See: https://developer.konghq.com/plugins/openid-connect/reference/ for the list of properties
      - `auth_methods` string[] — Types of credentials/grants to enable.
      - `client_id` string[] — An array of strings representing the client id for the OpenID Connect provider. When multiple values are provided, the client ID and secrets pairs correspond based on their locations in the array.
      - `client_secret` string[] — An array of strings representing the client secret for the OpenID Connect provider. When multiple values are provided, the client ID and secrets pairs correspond based on their locations in the array.
      - `consumer_claims` array[] — An array containing an array of string paths representing the location of the claim in a nested object. For example, to map to user.info.id, set [ "user", "info", "id" ].
        - string[]
      - `consumer_groups_claim` string[] — The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload.
      - `consumer_groups_optional` boolean — Do not terminate the request if consumer groups mapping fails.
      - `consumer_optional` boolean — Do not terminate the request if consumer mapping fails.
      - `issuer` string — URL that identifies the OpenID Provider
      - `scopes` string[] — This field is referenceable.
      - `ssl_verify` boolean
      - `cache_tokens_salt` string, required — Salt used for generating the cache key that is used for caching the token endpoint requests.

## Response `201`

Identity Provider created successfully.

- union — **Pre-release Feature** This feature is currently in beta and is subject to change.
  - AIGatewayIdentityProviderKeyAuthResponse — **Pre-release Feature** This feature is currently in beta and is subject to change.
    - `display_name` string, required — The display name for this identity provider instance.
    - `name` string, required — Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID.
    - `labels` PublicLabels — Public labels store information about an entity that can be used for filtering a list of objects. Public labels are intended to store **PUBLIC** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
    - `managed_by` ManagedBy — Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character.
    - `type` 'key-auth', required
    - `config` object — Configuration for the Kong Key auth identity provider. For advanced use cases, additional config properties can be sent in the request body. See: https://developer.konghq.com/plugins/key-auth/reference/ for the list of properties
      - `hide_credentials` boolean — An optional boolean value telling the plugin to show or hide the credential from the upstream service. If true, the plugin strips the credential from the request.
      - `key_in_body` boolean — If enabled, reads the request body. Supported MIME types: application/www-form-urlencoded, application/json, and multipart/form-data.
      - `key_in_header` boolean — If enabled (default), the plugin reads the request header and tries to find the key in it.
      - `key_in_query` boolean — If enabled (default), the plugin reads the query parameter in the request and tries to find the key in it.
      - `key_names` string[] — An array of strings containing the names of the keys to look for in the request.
    - `id` string, uuid, required — Contains a unique identifier used for this resource.
    - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
    - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.
  - AIGatewayIdentityProviderOpenIDConnectResponse — **Pre-release Feature** This feature is currently in beta and is subject to change.
    - `display_name` string, required — The display name for this identity provider instance.
    - `name` string, required — Identifier for an AI Gateway entity. In some cases, this may be the entity name or ID.
    - `labels` PublicLabels — Public labels store information about an entity that can be used for filtering a list of objects. Public labels are intended to store **PUBLIC** metadata. Keys must be of length 1-63 characters, and cannot start with "kong", "konnect", "mesh", "kic", or "_".
    - `managed_by` ManagedBy — Stores information about what manages this entity, such as the tool or system responsible for its lifecycle (for example, `terraform`). Keys must be 1–63 characters long and start with an alphanumeric character.
    - `type` 'openid-connect', required
    - `config` object — Configuration for the OpenID Connect identity provider. For advanced use cases, additional config properties can be sent in the request body. See: https://developer.konghq.com/plugins/openid-connect/reference/ for the list of properties
      - `auth_methods` string[] — Types of credentials/grants to enable.
      - `client_id` string[] — An array of strings representing the client id for the OpenID Connect provider. When multiple values are provided, the client ID and secrets pairs correspond based on their locations in the array.
      - `client_secret` string[] — An array of strings representing the client secret for the OpenID Connect provider. When multiple values are provided, the client ID and secrets pairs correspond based on their locations in the array.
      - `consumer_claims` array[] — An array containing an array of string paths representing the location of the claim in a nested object. For example, to map to user.info.id, set [ "user", "info", "id" ].
        - string[]
      - `consumer_groups_claim` string[] — The claim used for consumer groups mapping. If multiple values are set, it means the claim is inside a nested object of the token payload.
      - `consumer_groups_optional` boolean — Do not terminate the request if consumer groups mapping fails.
      - `consumer_optional` boolean — Do not terminate the request if consumer mapping fails.
      - `issuer` string — URL that identifies the OpenID Provider
      - `scopes` string[] — This field is referenceable.
      - `ssl_verify` boolean
      - `cache_tokens_salt` string, required — Salt used for generating the cache key that is used for caching the token endpoint requests.
    - `id` string, uuid, required — Contains a unique identifier used for this resource.
    - `created_at` string, date-time, required — An ISO-8601 timestamp representation of entity creation date.
    - `updated_at` string, date-time, required — An ISO-8601 timestamp representation of entity update date.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `409` — Conflict
- `429` — Too Many Requests

---

[API](https://skmtc.net/kong/apis/konnect-api-go-sdk.md) · [All operations](https://skmtc.net/kong/apis/konnect-api-go-sdk/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/kong/konnect-api-go-sdk/versions/0261aef4b1e2/schema)