---
title: "Register an identity provider for a verified domain"
method: POST
path: "/organizations/{organizationID}/sso/providers"
tags: ["Organizations"]
---

# Register an identity provider for a verified domain

`POST /organizations/{organizationID}/sso/providers`

## Request

- Base URL: `https://api.xata.tech`
- URL: `https://api.xata.tech/organizations/{organizationID}/sso/providers`
- Auth: OAuth 2
  - Implicit: `https://auth.xata.io/realms/xata/protocol/openid-connect/auth`
  - Scopes: `org:write`

Registers an identity provider for one verified domain. `google` needs only the credentials and pins the login
to that Google Workspace domain; `microsoft` pins it to the Entra tenant in the issuer; `oidc` is the fallback
for any other provider and discovers its endpoints from the issuer's `/.well-known/openid-configuration`. The
domain must already be verified, and registering does not redirect anyone on its own: that is enabled
separately.

## Request body

- CreateOrganizationSSOProviderRequest: Request payload for registering an identity provider for a verified domain
  - `type` 'google' | 'microsoft' | 'oidc', required: Which identity provider this is. `google` pins the login to a Google Workspace domain and `microsoft` to a single Entra tenant, taken from the issuer; `oidc` is the fallback for anything else that speaks OpenID Connect.
  - `domain` string, required: The verified email domain this provider will serve.
  - `issuer` string, uri: OIDC issuer URL. Required for `oidc`, and for `microsoft` where it names the Entra tenant; ignored for `google`. Must be https, and must serve a /.well-known/openid-configuration document naming itself as the issuer.
  - `client_id` string, required: OAuth client ID the organization registered with the provider
  - `client_secret` string, required: OAuth client secret. Write-only: it is stored in Keycloak and is never returned by this API.

## Response `201`

Identity provider registered

- OrganizationSSOProvider: An identity provider serving one of the organization's verified domains. The client secret is write-only and is never returned.
  - `alias` string, required: Stable identifier for this provider, used in its own endpoints.
  - `type` 'google' | 'microsoft' | 'oidc', required: Which identity provider this is. `google` pins the login to a Google Workspace domain and `microsoft` to a single Entra tenant, taken from the issuer; `oidc` is the fallback for anything else that speaks OpenID Connect.
  - `display_name` string, required: Name members see for this provider when signing in.
  - `domain` string, required: The verified email domain this provider serves. Empty while the domain is not verified.
  - `enforced` boolean, required: Whether members on this domain are sent to this provider automatically, leaving no other way in. Registering a provider does not set this; it is enabled separately.
  - `issuer` string, uri: OIDC issuer URL, without the /.well-known suffix.
  - `client_id` string, required: OAuth client ID the organization registered with the provider.

## Other responses

- `400`: Error returned when the request is malformed or contains invalid parameters
- `401`: Error returned when authentication or authorization fails
- `403`: Single sign-on is not enabled for the organization, or the caller is not an Admin
- `409`: The domain is not verified, or already has an identity provider
- `5XX`: Unexpected Error

## Changes

- **2026-09-24** `a9044087aadf`: 1 info
  - removed the non-success response with the status `404`
- **2026-09-11** `dea04a8fcb58`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/xata/apis/xata-api/changes/organizations/:organizationID/sso/providers/post.md)

---

[API](https://skmtc.dev/xata/apis/xata-api.md) - [All operations](https://skmtc.dev/xata/apis/xata-api/llms.txt) - [OpenAPI document](https://skmtc.dev/xata/apis/xata-api/revisions/3145f2078d68?raw)