---
title: "Configure Sso"
method: POST
path: "/supertokens/configure/{provider}"
tags: ["SUPERTOKENS"]
---

# Configure Sso

`POST /supertokens/configure/{provider}`

Configures SSO by creating a tenant if needed and updating third-party config

Self-service: the target is the tenant the caller addressed, never a request
parameter, so this route was never the cross-tenant vector.

Uses `get_request_tenant`, not `get_tenant`: a SuperTokens tenant id is the
host as-is, so a caller on `pepsico.*` must configure the `pepsico`
SuperTokens tenant. Collapsing to the canonical `pepsiaws-us-east` wrote the
config to a tenant that login never reads, because the frontend SDK sets
`getTenantId: getTenant` (the subdomain) and Okta login calls
`/superauth/{subdomain}/authorisationurl`. Identical for the 38 tenants whose
host already is their canonical name.
:return: ok status and optional message.

## Path parameters

- `provider` 'okta', required

## Request body

- ConfigureRequest
  - `client_id` string, required
  - `client_secret` string, required
  - `oidc_url` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `400` — Invalid request data
- `403` — Not supported for public user
- `422` — Validation Error

---

[API](https://skmtc.net/myaltimate/apis/fastapi.md) · [All operations](https://skmtc.net/myaltimate/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/myaltimate/fastapi/versions/50769cbf05d5/schema)