Sign in

v7

latestOpenAPI 3.0.3raw.githubusercontent.com2026-08-013764062.2 MB
Auth

Set OIDC settings

Enterprise feature

Configure OpenID Connect as a login provider for Unleash.

post/api/admin/auth/oidc/settings

Request body

OR

Example request

{
  "enabled": true,
  "discoverUrl": "https://myoidchost.azure.com/.well-known/openid-configuration",
  "clientId": "FB87266D-CDDB-4BCF-BB1F-8392FD0EDC1B",
  "secret": "qjcVfeFjEfoYAF3AEsX2IMUWYuUzAbXO",
  "defaultRootRoleId": 2,
  "emailDomains": "getunleash.io,getunleash.ai",
  "acrValues": "urn:okta:loa:2fa:any phr",
  "idTokenSigningAlgorithm": "RS256",
  "groupJsonPath": "groups",
  "extraScopes": "custom_scope1 custom_scope2"
}

Response

oidcSettingsResponseSchema

enabledtrue

Whether to enable or disable OpenID Connect for this instance

discoverUrlstring uri

The .well-known OpenID discover URL

clientIdstring

The OIDC client ID of this application.

secretstring

Shared secret from OpenID server. Used to authenticate login requests

autoCreateboolean

Auto create users based on email addresses from login tokens

enableSingleSignOutboolean

Support Single sign out when user clicks logout in Unleash. If true user is signed out of all OpenID Connect sessions against the clientId they may have active

defaultRootRole'Viewer' | 'Editor' | 'Admin'

Default role granted to users auto-created from email. Only relevant if autoCreate is true

defaultRootRoleIdnumber

Assign this root role to auto created users. Should be a role ID and takes precedence over defaultRootRole.

emailDomainsstring

Comma separated list of email domains that are automatically approved for an account in the server. Only relevant if autoCreate is true

acrValuesstring

Authentication Context Class Reference, used to request extra values in the acr claim returned from the server. If multiple values are required, they should be space separated. Consult the OIDC reference for more information

idTokenSigningAlgorithm'RS256' | 'RS384' | 'RS512'

The signing algorithm used to sign our token. Refer to the JWT signatures documentation for more information.

enableGroupSyncingboolean

Should we enable group syncing. Refer to the documentation Group syncing

groupJsonPathstring

Specifies the path in the OIDC token response to read which groups the user belongs to from.

addGroupsScopeboolean

When enabled Unleash will also request the 'groups' scope as part of the login request.

enablePkceboolean

Enable PKCE (Proof Key for Code Exchange) for enhanced security. Recommended for public clients and provides additional protection against authorization code interception attacks.

extraScopesstring

Space-separated list of additional scopes to request during login, beyond the default openid email profile and groups if group syncing is enabled.

Example response

{
  "enabled": true,
  "discoverUrl": "https://myoidchost.azure.com/.well-known/openid-configuration",
  "clientId": "FB87266D-CDDB-4BCF-BB1F-8392FD0EDC1B",
  "secret": "qjcVfeFjEfoYAF3AEsX2IMUWYuUzAbXO",
  "defaultRootRoleId": 2,
  "emailDomains": "getunleash.io,getunleash.ai",
  "acrValues": "urn:okta:loa:2fa:any phr",
  "idTokenSigningAlgorithm": "RS256",
  "groupJsonPath": "groups",
  "extraScopes": "custom_scope1 custom_scope2"
}