---
title: "Set OIDC settings"
method: POST
path: "/api/admin/auth/oidc/settings"
tags: ["Auth"]
---

# Set OIDC settings

`POST /api/admin/auth/oidc/settings`

**Enterprise feature**

Configure OpenID Connect as a login provider for Unleash.

## Request body

- union — Settings for configuring OpenID Connect as a login provider for Unleash
  - object
    - `enabled` true, required — Whether to enable or disable OpenID Connect for this instance
    - `discoverUrl` string, uri — The [.well-known OpenID discover URL](https://swagger.io/docs/specification/authentication/openid-connect-discovery/)
    - `clientId` string, required — The OIDC client ID of this application.
    - `secret` string, required — Shared secret from OpenID server. Used to authenticate login requests
    - `autoCreate` boolean — Auto create users based on email addresses from login tokens
    - `enableSingleSignOut` boolean — Support Single sign out when user clicks logout in Unleash. If `true` user is signed out of all OpenID Connect sessions against the clientId they may have active
    - `defaultRootRole` 'Viewer' | 'Editor' | 'Admin' — [Default role](https://docs.getunleash.io/concepts/rbac#standard-roles) granted to users auto-created from email. Only relevant if autoCreate is `true`
    - `defaultRootRoleId` number — Assign this root role to auto created users. Should be a role ID and takes precedence over `defaultRootRole`.
    - `emailDomains` string — Comma separated list of email domains that are automatically approved for an account in the server. Only relevant if autoCreate is `true`
    - `acrValues` string — Authentication Context Class Reference, used to request extra values in the acr claim returned from the server. If multiple values are required, they should be space separated. Consult [the OIDC reference](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint) for more information
    - `idTokenSigningAlgorithm` 'RS256' | 'RS384' | 'RS512' — The signing algorithm used to sign our token. Refer to the [JWT signatures](https://jwt.io/introduction) documentation for more information.
    - `enableGroupSyncing` boolean — Should we enable group syncing. Refer to the documentation [Group syncing](https://docs.getunleash.io/single-sign-on/how-to-set-up-group-sso-sync)
    - `groupJsonPath` string — Specifies the path in the OIDC token response to read which groups the user belongs to from.
    - `addGroupsScope` boolean — When enabled Unleash will also request the 'groups' scope as part of the login request.
    - `enablePkce` boolean — Enable PKCE (Proof Key for Code Exchange) for enhanced security. Recommended for public clients and provides additional protection against authorization code interception attacks.
    - `extraScopes` string — Space-separated list of additional scopes to request during login, beyond the default `openid email profile` and `groups` if group syncing is enabled.
  - object
    - `enabled` false — Whether to enable or disable OpenID Connect for this instance
    - `discoverUrl` string, uri — The [.well-known OpenID discover URL](https://swagger.io/docs/specification/authentication/openid-connect-discovery/)
    - `clientId` string — The OIDC client ID of this application.
    - `secret` string — Shared secret from OpenID server. Used to authenticate login requests
    - `autoCreate` boolean — Auto create users based on email addresses from login tokens
    - `enableSingleSignOut` boolean — Support Single sign out when user clicks logout in Unleash. If `true` user is signed out of all OpenID Connect sessions against the clientId they may have active
    - `defaultRootRole` 'Viewer' | 'Editor' | 'Admin' — [Default role](https://docs.getunleash.io/concepts/rbac#standard-roles) granted to users auto-created from email. Only relevant if autoCreate is `true`
    - `defaultRootRoleId` number — Assign this root role to auto created users. Should be a role ID and takes precedence over `defaultRootRole`.
    - `emailDomains` string — Comma separated list of email domains that are automatically approved for an account in the server. Only relevant if autoCreate is `true`
    - `acrValues` string — Authentication Context Class Reference, used to request extra values in the acr claim returned from the server. If multiple values are required, they should be space separated. Consult [the OIDC reference](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint) for more information
    - `idTokenSigningAlgorithm` 'RS256' | 'RS384' | 'RS512' — The signing algorithm used to sign our token. Refer to the [JWT signatures](https://jwt.io/introduction) documentation for more information.
    - `enableGroupSyncing` boolean — Should we enable group syncing. Refer to the documentation [Group syncing](https://docs.getunleash.io/single-sign-on/how-to-set-up-group-sso-sync)
    - `groupJsonPath` string — Specifies the path in the OIDC token response to read which groups the user belongs to from.
    - `addGroupsScope` boolean — When enabled Unleash will also request the 'groups' scope as part of the login request.
    - `enablePkce` boolean — Enable PKCE (Proof Key for Code Exchange) for enhanced security. Recommended for public clients and provides additional protection against authorization code interception attacks.
    - `extraScopes` string — Space-separated list of additional scopes to request during login, beyond the default `openid email profile` and `groups` if group syncing is enabled.

## Response `200`

oidcSettingsResponseSchema

- OidcSettingsResponseSchema — Response for OpenID Connect settings
  - `enabled` true — Whether to enable or disable OpenID Connect for this instance
  - `discoverUrl` string, uri — The [.well-known OpenID discover URL](https://swagger.io/docs/specification/authentication/openid-connect-discovery/)
  - `clientId` string — The OIDC client ID of this application.
  - `secret` string — Shared secret from OpenID server. Used to authenticate login requests
  - `autoCreate` boolean — Auto create users based on email addresses from login tokens
  - `enableSingleSignOut` boolean — Support Single sign out when user clicks logout in Unleash. If `true` user is signed out of all OpenID Connect sessions against the clientId they may have active
  - `defaultRootRole` 'Viewer' | 'Editor' | 'Admin' — [Default role](https://docs.getunleash.io/concepts/rbac#standard-roles) granted to users auto-created from email. Only relevant if autoCreate is `true`
  - `defaultRootRoleId` number — Assign this root role to auto created users. Should be a role ID and takes precedence over `defaultRootRole`.
  - `emailDomains` string — Comma separated list of email domains that are automatically approved for an account in the server. Only relevant if autoCreate is `true`
  - `acrValues` string — Authentication Context Class Reference, used to request extra values in the acr claim returned from the server. If multiple values are required, they should be space separated. Consult [the OIDC reference](https://openid.net/specs/openid-connect-core-1_0.html#AuthorizationEndpoint) for more information
  - `idTokenSigningAlgorithm` 'RS256' | 'RS384' | 'RS512' — The signing algorithm used to sign our token. Refer to the [JWT signatures](https://jwt.io/introduction) documentation for more information.
  - `enableGroupSyncing` boolean — Should we enable group syncing. Refer to the documentation [Group syncing](https://docs.getunleash.io/single-sign-on/how-to-set-up-group-sso-sync)
  - `groupJsonPath` string — Specifies the path in the OIDC token response to read which groups the user belongs to from.
  - `addGroupsScope` boolean — When enabled Unleash will also request the 'groups' scope as part of the login request.
  - `enablePkce` boolean — Enable PKCE (Proof Key for Code Exchange) for enhanced security. Recommended for public clients and provides additional protection against authorization code interception attacks.
  - `extraScopes` string — Space-separated list of additional scopes to request during login, beyond the default `openid email profile` and `groups` if group syncing is enabled.

## Other responses

- `400` — The request data does not match what we expect.
- `401` — Authorization information is missing or invalid. Provide a valid API token as the `authorization` header, e.g. `authorization:*.*.my-admin-token`.
- `403` — The provided user credentials are valid, but the user does not have the necessary permissions to perform this operation
- `415` — The operation does not support request payloads of the provided type. Please ensure that you're using one of the listed payload types and that you have specified the right content type in the "content-type" header.

---

[API](https://skmtc.net/unleash/apis/unleash-api-3.md) · [All operations](https://skmtc.net/unleash/apis/unleash-api-3/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/unleash/unleash-api-3/revisions/b2c3116e633e/schema)