---
title: "Create Auth Provider"
method: POST
path: "/v2/orgs/{orgSlug}/auth/sso"
tags: ["API Gateway"]
---

# Create Auth Provider

`POST /v2/orgs/{orgSlug}/auth/sso`

## Request

- Base URL: `https://api.studio.prisme.ai`
- URL: `https://api.studio.prisme.ai/v2/orgs/{orgSlug}/auth/sso`
- Auth: one of:
  - HTTP bearer
  - API key in header `x-prismeai-api-key`
  - HTTP bearer and API key in header `x-prismeai-api-key`
- TypeScript: <https://skmtc.dev/prisme/apis/prisme-ai-apis/docs/v2/orgs/:orgSlug/auth/sso/post.ts> (a function with typed inputs; its response is checked against the schema)

Create a new SSO auth provider (super admin only)

## Path parameters

- `orgSlug` string, required

## Request body

- AuthProvider
  - `id` string
  - `slug` string, required: Unique provider identifier (e.g. "google", "okta-saml")
  - `name` string: Display name for the provider (e.g. "Google", "Corporate SSO")
  - `icon` string: Icon URL or identifier for the provider
  - `type` 'oidc' | 'saml', required
  - `config` union, required: Provider-specific configuration (OIDC or SAML settings)
    - object
      - `client_id` string, required
      - `client_secret` string
      - `authorization_endpoint` string, required
      - `token_endpoint` string, required
      - `scopes` string[]
      - `state` boolean
      - `jwks_uri` string, required
      - `pkce` boolean
    - object
      - `idp_metadata_filepath` string: Absolute path to the SAML XML config file in the container
      - `idp_metadata_xml` string: Raw SAML XML config
      - `issuer` string: Required
      - `audience` string: Required, should match issuer
      - `skipRequestCompression` boolean
      - `wantAuthnResponseSigned` boolean
      - `identifierFormat` string: Required if neither idp_metadata_xml or idp_metadata_filepath are configured
      - `identityProviderUrl` string: Required if neither idp_metadata_xml or idp_metadata_filepath are configured
      - `entryPoint` string: Required if neither idp_metadata_xml or idp_metadata_filepath are configured
      - `logoutUrl` string
      - `idpCert` string: Required if neither idp_metadata_xml or idp_metadata_filepath are configured
  - `attributesMapping` object: Maps provider claims to user fields (e.g. firstName, email)
    - `firstName` string
    - `lastName` string
    - `email` string
  - `source` 'file' | 'database': Where this provider is configured (read-only, returned by GET)
  - `enabled` boolean: Whether this provider is active (default true). Disabled providers are not registered as passport strategies.
  - `meta` object: Free-form metadata JSON
  - `domains` string[]: Associated domain names
  - `orgSlug` string: Associated organization slug

## Response `200`

Success Response

- AuthProvider
  - `id` string
  - `slug` string, required: Unique provider identifier (e.g. "google", "okta-saml")
  - `name` string: Display name for the provider (e.g. "Google", "Corporate SSO")
  - `icon` string: Icon URL or identifier for the provider
  - `type` 'oidc' | 'saml', required
  - `config` union, required: Provider-specific configuration (OIDC or SAML settings)
    - object
      - `client_id` string, required
      - `client_secret` string
      - `authorization_endpoint` string, required
      - `token_endpoint` string, required
      - `scopes` string[]
      - `state` boolean
      - `jwks_uri` string, required
      - `pkce` boolean
    - object
      - `idp_metadata_filepath` string: Absolute path to the SAML XML config file in the container
      - `idp_metadata_xml` string: Raw SAML XML config
      - `issuer` string: Required
      - `audience` string: Required, should match issuer
      - `skipRequestCompression` boolean
      - `wantAuthnResponseSigned` boolean
      - `identifierFormat` string: Required if neither idp_metadata_xml or idp_metadata_filepath are configured
      - `identityProviderUrl` string: Required if neither idp_metadata_xml or idp_metadata_filepath are configured
      - `entryPoint` string: Required if neither idp_metadata_xml or idp_metadata_filepath are configured
      - `logoutUrl` string
      - `idpCert` string: Required if neither idp_metadata_xml or idp_metadata_filepath are configured
  - `attributesMapping` object: Maps provider claims to user fields (e.g. firstName, email)
    - `firstName` string
    - `lastName` string
    - `email` string
  - `source` 'file' | 'database': Where this provider is configured (read-only, returned by GET)
  - `enabled` boolean: Whether this provider is active (default true). Disabled providers are not registered as passport strategies.
  - `meta` object: Free-form metadata JSON
  - `domains` string[]: Associated domain names
  - `orgSlug` string: Associated organization slug

## Other responses

- `400`: Bad parameters
- `401`: AuthenticationError

---

[API](https://skmtc.dev/prisme/apis/prisme-ai-apis.md) - [All operations](https://skmtc.dev/prisme/apis/prisme-ai-apis/llms.txt) - [OpenAPI document](https://skmtc.dev/prisme/apis/prisme-ai-apis/revisions/b702c3eef2f2?raw)