Set OAuth provider | API Reference | Descope Documentation

POST

/v1/mgmt/oauth/provider

Authorization

Descope Project ID and Management Key

AuthorizationBearer <token>

Project ID:Management Key as bearer token.

In: header

Request Body

application/json

id?string

enabled?boolean

useSelfAccount?boolean

Whether logins use the caller's own OAuth app credentials rather than Descope's shared app; always true for custom providers

clientId?string

clientSecret?string

Write-only. Read returns PLACEHOLDER_VALUE when set. PLACEHOLDER_VALUE=keep, ""=clear (rejected when required), value=set

callbackDomain?string

redirectUrl?string

scopes?object

Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.

prompts?unknown

Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.

allowedGrantTypes?unknown

Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.

manageProviderTokens?boolean

trustProvidedEmails?boolean

jitUpdatesDisabled?boolean

useNonce?boolean

useClientAssertion?boolean

description?string

Configuration fields for custom providers; Descope-managed and rejected on system provider writes

logo?string

issuer?string

authUrl?string

tokenUrl?string

userDataUrl?string

jwksUrl?string

userDataClaimsMapping?object

Note that this is used both in SSO settings and in OAuth settings import/export, make sure not to change any fields which might break backwards compatibility with existing exported project data

nativeClientId?string

Native (mobile) client credentials

nativeClientSecret?string

Write-only. Read returns PLACEHOLDER_VALUE when set. PLACEHOLDER_VALUE=keep, ""=clear (rejected when required), value=set

appleKeyGenerator?object

Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.

nativeAppleKeyGenerator?unknown

Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.

Create or update a single OAuth provider, using a valid management key.

curl -X POST "https://api.descope.com/v1/mgmt/oauth/provider" \
  -H "Content-Type: application/json" \
  -d '{}'

curl -X POST "https://api.descope.com/v1/mgmt/oauth/provider" \  -H "Content-Type: application/json" \  -d '{}'

ResponseOK

{
  "id": "string",
  "enabled": true,
  "useSelfAccount": true,
  "clientId": "string",
  "clientSecret": "string",
  "callbackDomain": "string",
  "redirectUrl": "string",
  "scopes": null,
  "prompts": null,
  "allowedGrantTypes": null,
  "manageProviderTokens": true,
  "trustProvidedEmails": true,
  "jitUpdatesDisabled": true,
  "useNonce": true,
  "useClientAssertion": true,
  "description": "string",
  "logo": "string",
  "issuer": "string",
  "authUrl": "string",
  "tokenUrl": "string",
  "userDataUrl": "string",
  "jwksUrl": "string",
  "userDataClaimsMapping": {
    "loginId": "string",
    "username": "string",
    "name": "string",
    "email": "string",
    "verifiedEmail": "string",
    "verifiedPhone": "string",
    "picture": "string",
    "givenName": "string",
    "middleName": "string",
    "familyName": "string",
    "customAttributes": {
      "property1": "string",
      "property2": "string"
    },
    "group": "string"
  },
  "nativeClientId": "string",
  "nativeClientSecret": "string",
  "appleKeyGenerator": null,
  "nativeAppleKeyGenerator": null
}

{  "id": "string",  "enabled": true,  "useSelfAccount": true,  "clientId": "string",  "clientSecret": "string",  "callbackDomain": "string",  "redirectUrl": "string",  "scopes": null,  "prompts": null,  "allowedGrantTypes": null,  "manageProviderTokens": true,  "trustProvidedEmails": true,  "jitUpdatesDisabled": true,  "useNonce": true,  "useClientAssertion": true,  "description": "string",  "logo": "string",  "issuer": "string",  "authUrl": "string",  "tokenUrl": "string",  "userDataUrl": "string",  "jwksUrl": "string",  "userDataClaimsMapping": {    "loginId": "string",    "username": "string",    "name": "string",    "email": "string",    "verifiedEmail": "string",    "verifiedPhone": "string",    "picture": "string",    "givenName": "string",    "middleName": "string",    "familyName": "string",    "customAttributes": {      "property1": "string",      "property2": "string"    },    "group": "string"  },  "nativeClientId": "string",  "nativeClientSecret": "string",  "appleKeyGenerator": null,  "nativeAppleKeyGenerator": null}

TypeScript

/**
 * Single OAuth provider (Terraform: descope_oauth_provider). The id is the provider identity: the lowercase
 *  name of a system provider ("google"), or the caller-chosen key of a custom provider. Patch semantics:
 *  omitted fields are left untouched; present fields are written. The Get response uses the same message with
 *  all fields populated, except that Descope-managed fields of system providers (description, logo, issuer,
 *  the connection endpoints and the claims mapping) are rejected on write and omitted on read.
 */
export interface Response {
id?: string
enabled?: boolean
/**
 * Whether logins use the caller's own OAuth app credentials rather than Descope's shared app; always true for custom providers
 */
useSelfAccount?: boolean
clientId?: string
/**
 * Write-only. Read returns PLACEHOLDER_VALUE when set. PLACEHOLDER_VALUE=keep, ""=clear (rejected when required), value=set
 */
clientSecret?: string
callbackDomain?: string
redirectUrl?: string
/**
 * JSON arrays of strings; Value makes empty and absent distinct: null/absent = keep, [] = clear, values = set. Validated in the service
 */
scopes?: {
[k: string]: unknown
}
/**
 * Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
 */
prompts?: {
[k: string]: unknown
}
/**
 * Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
 */
allowedGrantTypes?: {
[k: string]: unknown
}
manageProviderTokens?: boolean
trustProvidedEmails?: boolean
jitUpdatesDisabled?: boolean
useNonce?: boolean
useClientAssertion?: boolean
/**
 * Configuration fields for custom providers; Descope-managed and rejected on system provider writes
 */
description?: string
logo?: string
issuer?: string
authUrl?: string
tokenUrl?: string
userDataUrl?: string
jwksUrl?: string
/**
 * Replaced wholesale when present, left untouched when absent
 */
userDataClaimsMapping?: {
loginId?: string
username?: string
name?: string
email?: string
verifiedEmail?: string
verifiedPhone?: string
picture?: string
givenName?: string
middleName?: string
familyName?: string
customAttributes?: {
[k: string]: string
}
group?: string
}
/**
 * Native (mobile) client credentials
 */
nativeClientId?: string
/**
 * Write-only. Read returns PLACEHOLDER_VALUE when set. PLACEHOLDER_VALUE=keep, ""=clear (rejected when required), value=set
 */
nativeClientSecret?: string
/**
 * JSON objects with the AppleKeyGenerator fields (keyId, teamId, privateKey); Value makes empty and absent
 *  distinct: null/absent = keep, {} = clear, object = set. Only valid for the apple system provider. Validated in the service
 */
appleKeyGenerator?: {
[k: string]: unknown
}
/**
 * Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values.
 */
nativeAppleKeyGenerator?: {
[k: string]: unknown
}
}

/** * Single OAuth provider (Terraform: descope_oauth_provider). The id is the provider identity: the lowercase *  name of a system provider ("google"), or the caller-chosen key of a custom provider. Patch semantics: *  omitted fields are left untouched; present fields are written. The Get response uses the same message with *  all fields populated, except that Descope-managed fields of system providers (description, logo, issuer, *  the connection endpoints and the claims mapping) are rejected on write and omitted on read. */export interface Response {id?: stringenabled?: boolean/** * Whether logins use the caller's own OAuth app credentials rather than Descope's shared app; always true for custom providers */useSelfAccount?: booleanclientId?: string/** * Write-only. Read returns PLACEHOLDER_VALUE when set. PLACEHOLDER_VALUE=keep, ""=clear (rejected when required), value=set */clientSecret?: stringcallbackDomain?: stringredirectUrl?: string/** * JSON arrays of strings; Value makes empty and absent distinct: null/absent = keep, [] = clear, values = set. Validated in the service */scopes?: {[k: string]: unknown}/** * Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values. */prompts?: {[k: string]: unknown}/** * Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values. */allowedGrantTypes?: {[k: string]: unknown}manageProviderTokens?: booleantrustProvidedEmails?: booleanjitUpdatesDisabled?: booleanuseNonce?: booleanuseClientAssertion?: boolean/** * Configuration fields for custom providers; Descope-managed and rejected on system provider writes */description?: stringlogo?: stringissuer?: stringauthUrl?: stringtokenUrl?: stringuserDataUrl?: stringjwksUrl?: string/** * Replaced wholesale when present, left untouched when absent */userDataClaimsMapping?: {loginId?: stringusername?: stringname?: stringemail?: stringverifiedEmail?: stringverifiedPhone?: stringpicture?: stringgivenName?: stringmiddleName?: stringfamilyName?: stringcustomAttributes?: {[k: string]: string}group?: string}/** * Native (mobile) client credentials */nativeClientId?: string/** * Write-only. Read returns PLACEHOLDER_VALUE when set. PLACEHOLDER_VALUE=keep, ""=clear (rejected when required), value=set */nativeClientSecret?: string/** * JSON objects with the AppleKeyGenerator fields (keyId, teamId, privateKey); Value makes empty and absent *  distinct: null/absent = keep, {} = clear, object = set. Only valid for the apple system provider. Validated in the service */appleKeyGenerator?: {[k: string]: unknown}/** * Represents a dynamically typed value which can be either null, a number, a string, a boolean, a recursive struct value, or a list of values. */nativeAppleKeyGenerator?: {[k: string]: unknown}}

Was this helpful?