OIDC Connection Object

organization_id

string

required

Globally unique UUID that identifies a specific Organization. The organization_id is critical to perform operations on an Organization, so be sure to preserve this value. You may also use the organization_slug or organization_external_id here as a convenience.

connection_id

string

required

Globally unique UUID that identifies a specific OIDC Connection.

status

string

required

The status of the connection. The possible values are pending or active. See the Update OIDC Connection endpoint for more details.

display_name

string

required

A human-readable display name for the connection.

redirect_url

string

required

The callback URL for this OIDC connection. This value will be passed to the IdP to redirect the Member back to Stytch after a sign-in attempt.

client_id

string

required

The OAuth2.0 client ID used to authenticate login attempts. This will be provided by the IdP.

client_secret

string

required

The secret belonging to the OAuth2.0 client used to authenticate login attempts. This will be provided by the IdP.

issuer

string

required

A case-sensitive https:// URL that uniquely identifies the IdP. This will be provided by the IdP.

authorization_url

string

required

The location of the URL that starts an OAuth login at the IdP. This will be provided by the IdP.

token_url

string

required

The location of the URL that issues OAuth2.0 access tokens and OIDC ID tokens. This will be provided by the IdP.

userinfo_url

string

required

The location of the IDP's UserInfo Endpoint. This will be provided by the IdP.

jwks_url

string

required

The location of the IdP's JSON Web Key Set, used to verify credentials issued by the IdP. This will be provided by the IdP.

identity_provider

string

required

Name of the IdP. Enum with possible values: classlink, cyberark, duo, google-workspace, jumpcloud, keycloak, miniorange, microsoft-entra, okta, onelogin, pingfederate, rippling, salesforce, shibboleth, or generic.

Specifying a known provider allows Stytch to handle any provider-specific logic.

custom_scopes

string

required

A space-separated list of custom scopes that will be requested on every SSOStart call. If set, this value will replace the default set of OIDC scopes requested: openid email profile. Additional scopes can be requested using the custom_scopes query parameter on individual SSOStart calls.

attribute_mapping

object

An object that represents the attributes used to identify a Member. This object will map the IdP-defined User attributes to Stytch-specific values, which will appear on the member's Trusted Metadata.