zitadel idps create
Create an identity provider connection.
Usage
npx @zitadel/cli@latest idps create [flags]Flags
| Flag | Description |
|---|---|
-e, --env <value> | Environment to run against, e.g. production. Defaults to ZITADEL_ENV, then the hosting platform's build (VERCEL_ENV, or Netlify's CONTEXT), then development. |
--env-file <value> | Read ZITADEL_* values from this file ahead of the process environment. A relative path is read from the current directory, not from --cwd. Cannot be combined with --env. |
Required field flags
| Flag | Description |
|---|---|
--slug <value> | (required) Stable identifier, referenced by user schemas (x-auth-methods.sso.providers) and flow steps (sso_providers). |
--protocol <value> | (required) The protocol used by the identity provider. One of oidc. |
--display-name <value> | (required) Shown to the user on the sign-in button. |
Optional field flags
| Flag | Description |
|---|---|
--template <value> | Template hint for rendering the provider (logo, colors). |
--subject-claim <value> | Claim carrying the provider's stable subject identifier. |
--claim-mapping <value> | Repeatable claim_mapping entry: key=value for a string, key:=value for JSON. Maps user-schema property names (keys) to provider claim names (values). Can be given more than once. |
--verified-claims <value> | Repeatable verified_claims entry: key=value for a string, key:=value for JSON. Maps a verifiable user-schema property to its verification source: a claim name (read the claim) or the… Can be given more than once. |
Provisioning field flags
| Flag | Description |
|---|---|
--provisioning-creation <value> | One of disabled, auto. |
OIDC field flags
| Flag | Description |
|---|---|
--oidc-issuer <value> | (required with oidc.*) Discovery base. |
--oidc-jwks-uri <value> | JWKS endpoint, for a provider that exposes no .well-known document. |
--[no-]oidc-id-token-mapping | Read user claims from the id_token instead of the userinfo endpoint, for providers that populate only the… |
--oidc-authorization-endpoint <value> | For a provider that exposes no .well-known document. |
--oidc-token-endpoint <value> | For a provider that exposes no .well-known document. |
--oidc-userinfo-endpoint <value> | For a provider that exposes no .well-known document. |
--oidc-client-id <value> | (required with oidc.*) Either a literal in case the same client is used in all environments, or a ${{ NAME }} reference to a… |
--oidc-client-secret <value> | (required with oidc.*) A reference to the variable holding the client secret, never the secret itself. |
--oidc-token-endpoint-auth-method <value> | How the client authenticates at the token endpoint. One of client_secret_basic, client_secret_post. |
--oidc-scopes <value> | Repeatable, one value each. Must contain openid - without it the provider returns no id_token and the connection is not OIDC. Can be given more than once. |
--[no-]oidc-pkce-enabled | Send PKCE (code_challenge/code_verifier). |
--oidc-static-authorize-parameters <value> | Repeatable oidc.static_authorize_parameters entry: key=value for a string, key:=value for JSON. Extra provider-specific authorize parameters (for example prompt). Can be given more than once. |
Raw body flags
| Flag | Description |
|---|---|
--data <value> | Whole body as a JSON object. Field flags and --set apply over it. Not with --file. |
--file <value> | Read the body from a JSON file; - reads stdin. Field flags and --set apply over it. Not with --data. |
--set <value> | Set one field by its dot path: path=value, or path:=json for JSON. Repeatable; applied after the field flags, in order. A key that contains a dot is set through its parent: --set 'parent:={"a.b":"x"}'. Can be given more than once. |
It also takes the global flags.
Examples
npx @zitadel/cli@latest idps create --slug acme-sso --protocol oidc --display-name 'Acme SSO' --oidc-issuer https://sso.acme.example --oidc-client-id <client_id> --oidc-client-secret '${{ ACME_SSO_CLIENT_SECRET }}' --oidc-scopes openid --oidc-scopes profile --oidc-scopes email --json
npx @zitadel/cli@latest idps create --data '{...}' --json
npx @zitadel/cli@latest idps create --file ./identity-provider-connection.jsonAPI
It calls Create or revise an identity provider connection, POST /idps, in the Identity providers API.
Was this helpful?