---
title: "Get OIDC auth settings"
method: GET
path: "/api/admin/auth/oidc/settings"
tags: ["Auth"]
---

# Get OIDC auth settings

`GET /api/admin/auth/oidc/settings`

**Enterprise feature**

Returns the current settings for OIDC Authentication

## Response `200`

oidcSettingsResponseSchema

- OidcSettingsResponseSchema — Response for OpenID Connect settings
  - `enabled` true — Whether to enable or disable OpenID Connect for this instance
  - `discoverUrl` string, uri — The [.well-known OpenID discover URL](https://swagger.io/docs/specification/authentication/openid-connect-discovery/)
  - `clientId` string — The OIDC client ID of this application.
  - `secret` string — Shared secret from OpenID server. Used to authenticate login requests
  - `autoCreate` boolean — Auto create users based on email addresses from login tokens
  - `enableSingleSignOut` boolean — Support Single sign out when user clicks logout in Unleash. If `true` user is signed out of all OpenID Connect sessions against the clientId they may have active
  - `defaultRootRole` 'Viewer' | 'Editor' | 'Admin' — [Default role](https://docs.getunleash.io/concepts/rbac#standard-roles) granted to users auto-created from email. Only relevant if autoCreate is `true`
  - `defaultRootRoleId` number — Assign this root role to auto created users. Should be a role ID and takes precedence over `defaultRootRole`.
  - `emailDomains` string — Comma separated list of email domains that are automatically approved for an account in the server. Only relevant if autoCreate is `true`
  - `acrValues` string — Authentication Context Class Reference, used to request extra values in the acr claim returned from the server. If multiple values are required, they should be space separated. Consult [the OIDC reference](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint) for more information
  - `idTokenSigningAlgorithm` 'RS256' | 'RS384' | 'RS512' — The signing algorithm used to sign our token. Refer to the [JWT signatures](https://jwt.io/introduction) documentation for more information.
  - `enableGroupSyncing` boolean — Should we enable group syncing. Refer to the documentation [Group syncing](https://docs.getunleash.io/single-sign-on/how-to-set-up-group-sso-sync)
  - `groupJsonPath` string — Specifies the path in the OIDC token response to read which groups the user belongs to from.
  - `addGroupsScope` boolean — When enabled Unleash will also request the 'groups' scope as part of the login request.
  - `enablePkce` boolean — Enable PKCE (Proof Key for Code Exchange) for enhanced security. Recommended for public clients and provides additional protection against authorization code interception attacks.
  - `extraScopes` string — Space-separated list of additional scopes to request during login, beyond the default `openid email profile` and `groups` if group syncing is enabled.

## Other responses

- `400` — The request data does not match what we expect.
- `401` — Authorization information is missing or invalid. Provide a valid API token as the `authorization` header, e.g. `authorization:*.*.my-admin-token`.
- `403` — The provided user credentials are valid, but the user does not have the necessary permissions to perform this operation

---

[API](https://skmtc.net/unleash/apis/unleash-api-3.md) · [All operations](https://skmtc.net/unleash/apis/unleash-api-3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/unleash/unleash-api-3/revisions/b2c3116e633e/schema)