Update app SSO settings

<Info>This API is in beta. Endpoints, fields, and behavior may still change, so avoid depending on it in production.</Info>

Sets up or changes the app's own SSO provider, and turns SSO sign-in on for the app. The app's other login methods stay as they are. Turn those off with Update app.

The credentials and URLs you send take effect on the published app right away, including when you switch providers, so a switch can change or break live sign-ins before you deploy. The provider name and SSO being turned on reach the published app once you deploy the app.

Send only the fields you want to change. A field you leave out keeps its stored value, and an empty string clears it. Sending the masked client_secret from Get app SSO settings keeps the stored secret.

Changing name to a different provider deletes everything stored for the previous one, so send the new provider's settings in the same request.

After the save, the app needs a client_id, a client_secret, and either a discovery_url or both an auth_endpoint and a token_endpoint. A request that would leave any of these missing is rejected and nothing is saved.

The discovery_url is fetched before saving. If it can't serve a sign-in, the request is rejected. If the check fails in a way that may be temporary, the settings are saved and the response carries a warning.

Turning SSO on for an app that doesn't use it yet needs a plan that includes SSO for apps. An app that already uses SSO can keep changing its settings.

The settings are stored as the app's secrets whose names start with sso_, and the app's backend functions, if it has any, redeploy to pick them up.

This is limited to 20 requests a minute per caller for each app. Some workspaces have a different limit.

<Note>This endpoint accepts a personal API key belonging to a user with editor access to the app. A read-only key is refused, and workspace API keys are not accepted.</Note>

{
  "name": "okta",
  "client_id": "0oa8f2k1xyzAbCdE5d7",
  "client_secret": "kq3Vt1-9dPzLr0aYbN2x",
  "discovery_url": "https://acme.okta.com/.well-known/openid-configuration",
  "scope": "openid email profile",
  "auth_endpoint": "https://github.com/login/oauth/authorize",
  "token_endpoint": "https://github.com/login/oauth/access_token",
  "userinfo_endpoint": "https://api.github.com/user",
  "jwks_uri": "https://idp.acme.com/oauth2/keys",
  "tenant_id": "organizations",
  "okta_domain": "acme.okta.com"
}

{
  "status": "success",
  "auth_config": {
    "enable_apple_login": false,
    "enable_facebook_login": false,
    "enable_google_login": true,
    "enable_microsoft_login": false,
    "enable_sso_login": true,
    "enable_username_password": false,
    "sso_provider_name": "okta"
  },
  "warning": "The Discovery URL could not be verified because it did not respond in time. SSO login will fail while that persists."
}