---
title: "Get app SSO settings"
method: GET
path: "/api/apps/{app_id}/sso/settings"
---

# Get app SSO settings

`GET /api/apps/{app_id}/sso/settings`

## Request

- Base URL: `https://app.base44.com`
- URL: `https://app.base44.com/api/apps/{app_id}/sso/settings`
- Auth: HTTP bearer

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Returns the app's own SSO provider and its settings. This is the provider set up for this app, not the workspace's SSO.

The client secret is never returned. `client_secret` reads as a fixed mask when one is stored. Each provider only returns the settings it uses, so the rest read as empty strings.

Change them with [Update app SSO settings](/api-reference/update-app-sso-settings).

This is limited to 60 requests a minute per caller for each app. Some workspaces have a different limit.

<Note>This endpoint accepts a personal API key belonging to a user with editor access to the app, including a read-only key. Workspace API keys are not accepted.</Note>

## Path parameters

- `app_id` string, required: ID of the app.

## Response `200`

The app's SSO provider settings.

- AppSSOSettingsResponse: The app's own SSO provider settings, with the client secret masked.
  - `settings` AppSSOSettings, required
    - `name` string, required: Name of the app's SSO provider, or an empty string when none is set. The builder uses `google`, `microsoft`, `github`, or `okta` for those providers. Any other name is a custom OpenID Connect or OAuth provider.
    - `client_id` string, required: OAuth client ID from the identity provider, or an empty string when none is stored.
    - `client_secret` string, required: Reads `XXXXXXXXXXXXXXXXXXXX` when a client secret is stored, and an empty string when none is. The secret itself is never returned.
    - `discovery_url` string, required: OpenID Connect discovery URL, or an empty string when none is stored or the provider doesn't use one.
    - `scope` string, required: Scopes requested at sign-in, separated by spaces. Reads `openid email profile` when none is stored or the provider doesn't use one.
    - `auth_endpoint` string, required: Authorization endpoint for a provider without a discovery URL, or an empty string when none is stored or the provider doesn't use one.
    - `token_endpoint` string, required: Token endpoint for a provider without a discovery URL, or an empty string when none is stored or the provider doesn't use one.
    - `userinfo_endpoint` string, required: User info endpoint for a provider without a discovery URL, or an empty string when none is stored or the provider doesn't use one.
    - `jwks_uri` string, required: URL of the provider's signing keys, for a custom provider. The value is an empty string when none is stored or the provider doesn't use one.
    - `tenant_id` string, required: Microsoft Entra tenant ID, or an empty string when none is stored or the provider isn't `microsoft`.
    - `okta_domain` string, required: Okta domain, or an empty string when none is stored or the provider isn't `okta`.

## Other responses

- `401`: Missing or invalid credentials.
- `403`: You don't have editor access to this app, or you used a workspace API key.
- `404`: App not found.
- `429`: Too many requests for this app's SSO settings from you in the last minute.

## Changes

- **2026-10-13** `32455e516133`: 2 info
  - the security scope `read_only` was added to the endpoint's security scheme `PersonalAccessTokenAuth`
  - the security scope `full_access` was removed from the endpoint's security scheme `PersonalAccessTokenAuth`
- **2026-10-11** `80287813ab84`: 1 info
  - the endpoint scheme security `PersonalAccessTokenAuth` was added to the API
- **2026-09-29** `347e2afcf94a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/base44/apis/base44-app-management-api/changes/api/apps/:app_id/sso/settings/get.md)

---

[API](https://skmtc.dev/base44/apis/base44-app-management-api.md) - [All operations](https://skmtc.dev/base44/apis/base44-app-management-api/llms.txt) - [OpenAPI document](https://skmtc.dev/base44/apis/base44-app-management-api/revisions/c534f09cf314?raw)