---
title: "List all custom OIDC/OAuth providers"
method: GET
path: "/admin/custom-providers"
tags: ["admin", "oauth-client"]
---

# List all custom OIDC/OAuth providers

`GET /admin/custom-providers`

Retrieves a list of all custom OAuth 2.0 and OIDC provider configurations. Optionally filter by provider type. Only available when custom OIDC/OAuth providers are enabled (set `GOTRUE_CUSTOM_OAUTH_ENABLED=true` for self-hosted or enable in Supabase Dashboard).

## Query parameters

- `type` 'oauth2' | 'oidc'

## Response `200`

List of custom OIDC/OAuth providers

- object
  - `providers` CustomOAuthProviderSchema[]
    - `id` string, uuid, required — Unique provider identifier
    - `provider_type` 'oauth2' | 'oidc', required — Type of OAuth provider
    - `identifier` string, required — Unique identifier for the provider (must start with 'custom:' prefix)
    - `name` string, required — Human-readable name of the provider
    - `client_id` string, required — OAuth client ID
    - `acceptable_client_ids` string[] — Additional acceptable client IDs for token validation
    - `scopes` string[] — OAuth scopes to request (OIDC providers will automatically include 'openid')
    - `pkce_enabled` boolean — Whether PKCE (Proof Key for Code Exchange) is enabled
    - `attribute_mapping` object — Maps provider claims to user attributes
    - `custom_claims_allowlist` string[] — Raw IdP claim keys copied verbatim into the user's custom_claims (e.g. groups, org_id). For OIDC providers these are read from the ID token claims (falling back to the userinfo response when no ID token is returned); for OAuth2 providers they are read from the userinfo response. Empty preserves no non-standard claims.
    - `authorization_params` object — Additional parameters to include in authorization requests as string key-value pairs (cannot override reserved OAuth parameters)
    - `enabled` boolean — Whether the provider is enabled
    - `email_optional` boolean — Whether email is optional for users from this provider
    - `issuer` string, uri — OIDC issuer URL (required for OIDC providers)
    - `discovery_url` string, uri — OIDC discovery URL (optional, defaults to {issuer}/.well-known/openid-configuration)
    - `skip_nonce_check` boolean — Skip nonce validation for OIDC (not recommended for production)
    - `authorization_url` string, uri — OAuth 2.0 authorization endpoint (required for OAuth2 providers)
    - `token_url` string, uri — OAuth 2.0 token endpoint (required for OAuth2 providers)
    - `userinfo_url` string, uri — OAuth 2.0 userinfo endpoint (required for OAuth2 providers)
    - `jwks_uri` string, uri — JWKS URI for token validation (optional for OAuth2 providers)
    - `created_at` string, date-time
    - `updated_at` string, date-time

## Other responses

- `400` — Invalid type parameter
- `401` — HTTP Unauthorized response.
- `403` — HTTP Forbidden response.

---

[API](https://skmtc.net/supabase/apis/supabase-auth-rest-api.md) · [All operations](https://skmtc.net/supabase/apis/supabase-auth-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/supabase/supabase-auth-rest-api/versions/2664b89bee49/schema)