---
title: "Get custom OIDC/OAuth provider details"
method: GET
path: "/admin/custom-providers/{identifier}"
tags: ["admin", "oauth-client"]
---

# Get custom OIDC/OAuth provider details

`GET /admin/custom-providers/{identifier}`

Retrieves details of a specific custom OIDC/OAuth provider. Only available when custom OIDC/OAuth providers are enabled.

## Response `200`

Custom OIDC/OAuth provider details

- CustomOAuthProviderSchema — Represents a custom OAuth 2.0 or OIDC provider configuration
  - `id` string, uuid, required — Unique provider identifier
  - `provider_type` 'oauth2' | 'oidc', required — Type of OAuth provider
  - `identifier` string, required — Unique identifier for the provider (must start with 'custom:' prefix)
  - `name` string, required — Human-readable name of the provider
  - `client_id` string, required — OAuth client ID
  - `acceptable_client_ids` string[] — Additional acceptable client IDs for token validation
  - `scopes` string[] — OAuth scopes to request (OIDC providers will automatically include 'openid')
  - `pkce_enabled` boolean — Whether PKCE (Proof Key for Code Exchange) is enabled
  - `attribute_mapping` object — Maps provider claims to user attributes
  - `custom_claims_allowlist` string[] — Raw IdP claim keys copied verbatim into the user's custom_claims (e.g. groups, org_id). For OIDC providers these are read from the ID token claims (falling back to the userinfo response when no ID token is returned); for OAuth2 providers they are read from the userinfo response. Empty preserves no non-standard claims.
  - `authorization_params` object — Additional parameters to include in authorization requests as string key-value pairs (cannot override reserved OAuth parameters)
  - `enabled` boolean — Whether the provider is enabled
  - `email_optional` boolean — Whether email is optional for users from this provider
  - `issuer` string, uri — OIDC issuer URL (required for OIDC providers)
  - `discovery_url` string, uri — OIDC discovery URL (optional, defaults to {issuer}/.well-known/openid-configuration)
  - `skip_nonce_check` boolean — Skip nonce validation for OIDC (not recommended for production)
  - `authorization_url` string, uri — OAuth 2.0 authorization endpoint (required for OAuth2 providers)
  - `token_url` string, uri — OAuth 2.0 token endpoint (required for OAuth2 providers)
  - `userinfo_url` string, uri — OAuth 2.0 userinfo endpoint (required for OAuth2 providers)
  - `jwks_uri` string, uri — JWKS URI for token validation (optional for OAuth2 providers)
  - `created_at` string, date-time
  - `updated_at` string, date-time

## Other responses

- `400` — Invalid identifier format
- `401` — HTTP Unauthorized response.
- `403` — HTTP Forbidden response.
- `404` — Provider not found

---

[API](https://skmtc.net/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.net/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/versions/2664b89bee49/schema)