---
title: "Create or update team SSO configuration"
method: PUT
path: "/api/user/teams/{id}/sso"
tags: ["Teams"]
---

# Create or update team SSO configuration

`PUT /api/user/teams/{id}/sso`

## Request

- Base URL: `https://demo.hitkeep.com`
- URL: `https://demo.hitkeep.com/api/user/teams/{id}/sso`
- Auth: API key in cookie `hk_token`

Validates OIDC discovery and stores the client secret encrypted with the instance key. Leave client_secret blank to keep an existing secret, or provide a new value to rotate it. Enabling this configuration adds SSO as an optional login method; password login is unchanged.

## Path parameters

- `id` string, uuid, required

## Request body

- TeamSSOInput
  - `allowed_domains` string[], required
  - `auto_provision` boolean, required: When true, verified users from trusted domains may join this team as Members without an invitation. Managed-cloud seat and team limits still apply.
  - `client_id` string, required
  - `client_secret` string: Required on create. Blank preserves the stored secret on update.
  - `display_name_claim` string, required
  - `email_claim` string, required
  - `enabled` boolean, required
  - `issuer_url` string, uri, required
  - `provider_type` 'oidc', required

## Response `200`

Redacted team SSO configuration

- TeamSSOConfig: Redacted team OIDC configuration. The client secret is never returned.
  - `allowed_domains` string[], required
  - `auto_provision` boolean, required
  - `callback_url` string, uri, required
  - `client_id` string, required
  - `client_secret_configured` boolean, required
  - `display_name_claim` string, required
  - `email_claim` string, required
  - `enabled` boolean, required
  - `issuer_url` string, uri, required
  - `provider_type` 'oidc', required
  - `updated_at` string, date-time

## Other responses

- `400`: Invalid configuration or missing client secret
- `403`: Team settings permission or SSO entitlement required
- `409`: An allowed email domain belongs to another team SSO configuration
- `502`: OIDC discovery failed

---

[API](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api.md) · [All operations](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/hitkeep/apis/hitkeep-rest-api/revisions/bb2df36ab2a4?raw)