---
title: "POST /api/identity-providers"
method: POST
path: "/api/identity-providers"
tags: ["IdentityProviderService"]
---

# POST /api/identity-providers

`POST /api/identity-providers`

## Request

- The document declares no server URL.
- Auth: none declared

CreateIdentityProvider creates an identity provider.
 Requires the admin role. Fails with FAILED_PRECONDITION when the ID belongs to a provider configured by the
 deployment.

## Query parameters

- `identityProviderId` string

## Request body

- IdentityProvider: IdentityProvider is an external identity provider users can sign in with.
  - `name` string: Identifier. The resource name of the identity provider. Format: identity-providers/{idp}
  - `type` 'TYPE_UNSPECIFIED' | 'OAUTH2', enum, required: Required. The type of the identity provider.
  - `title` string, required: Required. The display title of the identity provider.
  - `identifierFilter` string: Optional. A regular expression the user identifier must match to sign in. Empty allows every identifier.
  - `config` IdentityProviderConfig, required: IdentityProviderConfig is the type-specific configuration of an identity provider.
    - `oauth2Config` OAuth2Config: OAuth2Config is the configuration of an OAuth2 identity provider.
      - `clientId` string: The OAuth2 client ID.
      - `clientSecret` string: The OAuth2 client secret. Write-only: it is never returned in responses.
      - `authUrl` string: The authorization endpoint URL.
      - `tokenUrl` string: The token endpoint URL, used to exchange the authorization code for an access token.
      - `userInfoUrl` string: The user info endpoint URL, used to fetch the claims of the signed-in user.
      - `scopes` string[]: The scopes to request.
      - `fieldMapping` FieldMapping: FieldMapping maps user info claims of an OAuth2 identity provider to user fields. Each field holds the name of a claim.
        - `identifier` string: The claim that uniquely identifies the user. Sign-in fails when it is missing or empty.
        - `displayName` string: The claim used as the display name. Falls back to the identifier when unset.
        - `email` string: The claim used as the email address.
        - `avatarUrl` string: The claim used as the avatar URL.

## Response `200`

OK

- IdentityProvider: IdentityProvider is an external identity provider users can sign in with.
  - `name` string: Identifier. The resource name of the identity provider. Format: identity-providers/{idp}
  - `type` 'TYPE_UNSPECIFIED' | 'OAUTH2', enum, required: Required. The type of the identity provider.
  - `title` string, required: Required. The display title of the identity provider.
  - `identifierFilter` string: Optional. A regular expression the user identifier must match to sign in. Empty allows every identifier.
  - `config` IdentityProviderConfig, required: IdentityProviderConfig is the type-specific configuration of an identity provider.
    - `oauth2Config` OAuth2Config: OAuth2Config is the configuration of an OAuth2 identity provider.
      - `clientId` string: The OAuth2 client ID.
      - `clientSecret` string: The OAuth2 client secret. Write-only: it is never returned in responses.
      - `authUrl` string: The authorization endpoint URL.
      - `tokenUrl` string: The token endpoint URL, used to exchange the authorization code for an access token.
      - `userInfoUrl` string: The user info endpoint URL, used to fetch the claims of the signed-in user.
      - `scopes` string[]: The scopes to request.
      - `fieldMapping` FieldMapping: FieldMapping maps user info claims of an OAuth2 identity provider to user fields. Each field holds the name of a claim.
        - `identifier` string: The claim that uniquely identifies the user. Sign-in fails when it is missing or empty.
        - `displayName` string: The claim used as the display name. Falls back to the identifier when unset.
        - `email` string: The claim used as the email address.
        - `avatarUrl` string: The claim used as the avatar URL.

## Other responses

- `default`: Default error response

## Changes

- **2026-10-08** `1846a777b0ef`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/usememos/apis/untitled-api/changes/api/identity-providers/post.md)

---

[API](https://skmtc.dev/usememos/apis/untitled-api.md) - [All operations](https://skmtc.dev/usememos/apis/untitled-api/llms.txt) - [OpenAPI document](https://skmtc.dev/usememos/apis/untitled-api/revisions/f587355e35b4?raw)