Identity Providers

Create an identity provider

Adds a new identity provider to the realm. Supply template_id from GET /identity-provider-templates to bootstrap configuration from a pre-built template.

Required scope: identity-providers:write

post/clusters/{cluster_id}/realms/{realm_name}/identity-providers

Request

  • Base URL: http://localhost:8000
  • URL: http://localhost:8000/clusters/{cluster_id}/realms/{realm_name}/identity-providers
  • Auth: API key in header API-Key

Path parameters

cluster_idstring uuid required
realm_namestring required

Keycloak realm name (not ID). Must start with a letter; allows letters, digits, and hyphens.

Example:customer-portal

Headers

API-Version'2026-06-01.beta' required

Request body

provider_id'oidc' | 'saml' | 'keycloak-oidc' | 'google' | 'github' | 'microsoft' | 'facebook' | 'gitlab' | 'bitbucket' | 'linkedin-openid-connect' | 'twitter' | 'instagram' | 'paypal' | 'stackoverflow' | 'openshift-v4' | 'google-workspace' | 'okta-oidc' | 'onelogin-oidc' | 'jumpcloud-oidc' | 'pingone-oidc' | 'auth0' | 'salesforce' | 'slack' | 'discord' | 'atlassian' | 'twitch' | 'custom-oidc' | 'google-workspace-saml' | 'okta-saml' | 'azure-ad-saml' | 'onelogin-saml' | 'jumpcloud-saml' | 'pingfederate-saml' | 'pingone-saml' | 'duo-saml' | 'cloudflare-saml' | 'cyberark-saml' | 'custom-saml' required

Supported Skycloak identity provider ID.

type'oidc' | 'saml' | 'ldap' required

Protocol of the identity provider.

display_namestring required
client_idstring

OAuth 2.0 / LDAP client identifier registered with the external provider.

client_secretstring password

Client secret or LDAP bind password. Write-only; never returned by the API.

template_idstring

Template ID from GET /identity-provider-templates. When provided, type and config are pre-filled with recommended defaults; explicit fields in this request override template values.

Example request

{
  "config": {
    "oidc": {
      "issuer": "https://accounts.google.com",
      "authorization_url": "https://accounts.google.com/o/oauth2/v2/auth",
      "token_url": "https://oauth2.googleapis.com/token",
      "userinfo_url": "https://openidconnect.googleapis.com/v1/userinfo"
    },
    "saml": {
      "entity_id": "https://idp.example.com/entity",
      "sso_url": "https://idp.example.com/sso/saml"
    },
    "ldap": {
      "server_url": "ldaps://ldap.example.com:636",
      "base_dn": "dc=example,dc=com",
      "bind_dn": "cn=skycloak-svc,ou=service-accounts,dc=example,dc=com"
    },
    "button_text": "Continue with Okta",
    "attribute_mappings": {
      "email": "email",
      "firstName": "given_name",
      "lastName": "family_name"
    }
  }
}

Response

The request has succeeded and a new resource has been created as a result.

provider_idstring required

Keycloak identity provider alias. Used as the stable resource identifier in this API and in Keycloak login flows.

type'oidc' | 'saml' | 'ldap' required

Protocol of the identity provider.

display_namestring required
enabledboolean required
client_idstring

Client identifier used to authenticate with the external provider. Not a secret.

externally_managedboolean required

When true, this provider was created or last modified directly in the Keycloak Admin Console. Skycloak reflects its configuration but PATCH and DELETE will return 403 Forbidden.

created_atstring date-time required
updated_atstring date-time required

Example response

{
  "provider_id": "google-workspace",
  "config": {
    "oidc": {
      "issuer": "https://accounts.google.com",
      "authorization_url": "https://accounts.google.com/o/oauth2/v2/auth",
      "token_url": "https://oauth2.googleapis.com/token",
      "userinfo_url": "https://openidconnect.googleapis.com/v1/userinfo"
    },
    "saml": {
      "entity_id": "https://idp.example.com/entity",
      "sso_url": "https://idp.example.com/sso/saml"
    },
    "ldap": {
      "server_url": "ldaps://ldap.example.com:636",
      "base_dn": "dc=example,dc=com",
      "bind_dn": "cn=skycloak-svc,ou=service-accounts,dc=example,dc=com"
    },
    "button_text": "Continue with Okta",
    "attribute_mappings": {
      "email": "email",
      "firstName": "given_name",
      "lastName": "family_name"
    }
  }
}

Changes

No recorded changes to this operation across all 1 revision of this API.