---
title: "Get OIDC configuration."
method: GET
path: "/security/oidc"
tags: ["oidc"]
---

# Get OIDC configuration.

`GET /security/oidc`

Returns the current OIDC configuration with secrets redacted. Includes indicators for fields overridden by environment variables.

## Response `200`

OIDC configuration

- OIDCConfigResponse — OIDC configuration (secrets redacted)
  - `enabled` boolean — Whether OIDC authentication is enabled
  - `issuer` string — OIDC provider issuer URL
  - `clientId` string — OAuth client ID
  - `clientSecret` string — Always empty (redacted for security)
  - `clientSecretSet` boolean — Whether a client secret has been configured
  - `redirectUri` string — OAuth redirect URI (optional, auto-generated if not set)
  - `scope` string — OAuth scopes to request
  - `defaultPermission` 'readonly' | 'readwrite' | 'admin' — Signal K permission level
  - `autoCreateUsers` boolean — Automatically create users on first OIDC login
  - `adminGroups` string[] — Groups that grant admin permission
  - `readwriteGroups` string[] — Groups that grant read/write permission
  - `groupsAttribute` string — ID token claim containing user groups
  - `providerName` string — Display name shown on login button
  - `autoLogin` boolean — Automatically redirect to OIDC provider when not authenticated
  - `envOverrides` object — Fields that are overridden by environment variables

## Other responses

- `401` — Unauthorized - admin access required

---

[API](https://skmtc.net/signalk/apis/signal-k-security-api.md) · [All operations](https://skmtc.net/signalk/apis/signal-k-security-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/signalk/signal-k-security-api/versions/9c4fd7143750/schema)