---
title: "Configure Sso"
method: POST
path: "/supertokens/configure/{provider}"
tags: ["SUPERTOKENS"]
---

# Configure Sso

`POST /supertokens/configure/{provider}`

Configures SSO by creating a tenant if needed and updating third-party config

Self-service: the target is the tenant the caller addressed, never a request
parameter, so this route was never the cross-tenant vector.

Uses `get_request_tenant`, not `get_tenant`: a SuperTokens tenant id is the
host as-is, so a caller on `pepsico.*` must configure the `pepsico`
SuperTokens tenant. Collapsing to the canonical `pepsiaws-us-east` wrote the
config to a tenant that login never reads, because the frontend SDK sets
`getTenantId: getTenant` (the subdomain) and SSO login calls
`/superauth/{subdomain}/authorisationurl`. Identical for the 38 tenants whose
host already is their canonical name.
:return: ok status and optional message.

## Path parameters

- `provider` 'okta' | 'active-directory', required — Providers customers may configure themselves via `/configure/{provider}`. Deliberately narrower than `ThirdPartySSO`: this is the self-service allowlist, so a provider reachable through the support-assisted routes is not automatically exposed here.

## Request body

- ConfigureRequest
  - `client_id` string, required
  - `client_secret` string, required
  - `oidc_url` string, required

## Response `200`

Successful Response

- unknown

## Other responses

- `400` — Invalid request data
- `403` — Not supported for public user
- `422` — Validation Error

## Changes

- **2026-09-11** `70e0a3e5cb0d` — 1 info
  - added the new enum value `active-directory` to the `path` request parameter `provider`

[Change history](https://skmtc.dev/myaltimate/apis/fastapi/changes/supertokens/configure/:provider/post.md)

---

[API](https://skmtc.dev/myaltimate/apis/fastapi.md) · [All operations](https://skmtc.dev/myaltimate/apis/fastapi/llms.txt) · [OpenAPI document](https://skmtc.dev/myaltimate/apis/fastapi/revisions/eb8306fa77dd?raw)