Create OAuth login config
Create an OAuth login configuration for a specific provider. With
type: personal (the default) this is the classic social-login
config, at most one per provider. With type: enterprise it creates a
new OIDC SSO connection (returning a generated connection_id) and
requires the enterprise block.
curl --request POST \
--url https://api.prelude.dev/v2/session/apps/{appID}/config/login/oauth/{provider} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"client_id": "<string>",
"client_secret": "<string>",
"type": "personal",
"enabled": true,
"scopes": [
"<string>"
],
"granted_scopes": [
"<string>"
],
"options": {
"use_email_as_identifier": true,
"allow_email_account_merge": true,
"verify_email": true
},
"apple": {
"team_id": "<string>",
"key_id": "<string>",
"p8_key": "<string>"
},
"okta": {
"issuer_url": "<string>"
}
}
'import requests
url = "https://api.prelude.dev/v2/session/apps/{appID}/config/login/oauth/{provider}"
payload = {
"client_id": "<string>",
"client_secret": "<string>",
"type": "personal",
"enabled": True,
"scopes": ["<string>"],
"granted_scopes": ["<string>"],
"options": {
"use_email_as_identifier": True,
"allow_email_account_merge": True,
"verify_email": True
},
"apple": {
"team_id": "<string>",
"key_id": "<string>",
"p8_key": "<string>"
},
"okta": { "issuer_url": "<string>" }
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
client_id: '<string>',
client_secret: '<string>',
type: 'personal',
enabled: true,
scopes: ['<string>'],
granted_scopes: ['<string>'],
options: {
use_email_as_identifier: true,
allow_email_account_merge: true,
verify_email: true
},
apple: {team_id: '<string>', key_id: '<string>', p8_key: '<string>'},
okta: {issuer_url: '<string>'}
})
};
fetch('https://api.prelude.dev/v2/session/apps/{appID}/config/login/oauth/{provider}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.prelude.dev/v2/session/apps/{appID}/config/login/oauth/{provider}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'client_id' => '<string>',
'client_secret' => '<string>',
'type' => 'personal',
'enabled' => true,
'scopes' => [
'<string>'
],
'granted_scopes' => [
'<string>'
],
'options' => [
'use_email_as_identifier' => true,
'allow_email_account_merge' => true,
'verify_email' => true
],
'apple' => [
'team_id' => '<string>',
'key_id' => '<string>',
'p8_key' => '<string>'
],
'okta' => [
'issuer_url' => '<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.prelude.dev/v2/session/apps/{appID}/config/login/oauth/{provider}"
payload := strings.NewReader("{\n \"client_id\": \"<string>\",\n \"client_secret\": \"<string>\",\n \"type\": \"personal\",\n \"enabled\": true,\n \"scopes\": [\n \"<string>\"\n ],\n \"granted_scopes\": [\n \"<string>\"\n ],\n \"options\": {\n \"use_email_as_identifier\": true,\n \"allow_email_account_merge\": true,\n \"verify_email\": true\n },\n \"apple\": {\n \"team_id\": \"<string>\",\n \"key_id\": \"<string>\",\n \"p8_key\": \"<string>\"\n },\n \"okta\": {\n \"issuer_url\": \"<string>\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.prelude.dev/v2/session/apps/{appID}/config/login/oauth/{provider}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"client_id\": \"<string>\",\n \"client_secret\": \"<string>\",\n \"type\": \"personal\",\n \"enabled\": true,\n \"scopes\": [\n \"<string>\"\n ],\n \"granted_scopes\": [\n \"<string>\"\n ],\n \"options\": {\n \"use_email_as_identifier\": true,\n \"allow_email_account_merge\": true,\n \"verify_email\": true\n },\n \"apple\": {\n \"team_id\": \"<string>\",\n \"key_id\": \"<string>\",\n \"p8_key\": \"<string>\"\n },\n \"okta\": {\n \"issuer_url\": \"<string>\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.prelude.dev/v2/session/apps/{appID}/config/login/oauth/{provider}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"client_id\": \"<string>\",\n \"client_secret\": \"<string>\",\n \"type\": \"personal\",\n \"enabled\": true,\n \"scopes\": [\n \"<string>\"\n ],\n \"granted_scopes\": [\n \"<string>\"\n ],\n \"options\": {\n \"use_email_as_identifier\": true,\n \"allow_email_account_merge\": true,\n \"verify_email\": true\n },\n \"apple\": {\n \"team_id\": \"<string>\",\n \"key_id\": \"<string>\",\n \"p8_key\": \"<string>\"\n },\n \"okta\": {\n \"issuer_url\": \"<string>\"\n }\n}"
response = http.request(request)
puts response.read_body{
"config": {
"provider_id": "<string>",
"type": "personal",
"client_id": "<string>",
"enabled": true,
"scopes": [
"<string>"
],
"options": {
"use_email_as_identifier": true,
"allow_email_account_merge": true,
"verify_email": true
},
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"connection_id": "<string>",
"granted_scopes": [
"<string>"
],
"apple": {
"team_id": "<string>",
"key_id": "<string>",
"p8_key": "<string>"
},
"okta": {
"issuer_url": "<string>"
},
"enterprise": {
"issuer_url": "<string>",
"email_domain_allowlist": [
"<string>"
],
"jit_provisioning": true,
"allow_email_account_merge": true,
"enforce_login": true,
"sync_profile_on_login": true,
"default_redirect_uri": "<string>",
"claim_mapping": {
"email": "<string>",
"given_name": "<string>",
"family_name": "<string>",
"custom": {}
}
}
}
}{
"code": "invalid_request",
"status": "bad_request",
"message": "<string>"
}{
"code": "app_not_found",
"status": "not_found",
"message": "<string>"
}{
"code": "oauth_provider_already_configured",
"status": "conflict",
"message": "<string>"
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
The id of the app the request refers to. An application's unique identifier.
"54e9ujn"
"fvua38g"
The OAuth provider identifier.
"google"
"apple"
"github"
"microsoft"
"okta"
"facebook"
"linkedin"
Body
"123456789.apps.googleusercontent.com"
"GOCSPX-abc123def456"
personal is the classic social-login config (at most one per
provider, addressed as …/oauth/{provider}). enterprise is a
per-connection OIDC SSO config (any number per provider, addressed as
…/oauth/{provider}/{connectionID}). Defaults to personal.
personal, enterprise "enterprise"
true
Scopes requested from the OAuth provider (IdP).
Prelude session scopes attached to the session when a login completes through this social provider (for example prld:pwd:write). Distinct from scopes, which are requested from the IdP.
["prld:pwd:write"]
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Show child attributes
Required when type is enterprise, rejected otherwise. Its
email_domain_allowlist must be non-empty and must not overlap
another connection's, and the provider must be one of okta,
google, or microsoft.
Show child attributes
Show child attributes
Response
Created
Show child attributes
Show child attributes
curl --request POST \
--url https://api.prelude.dev/v2/session/apps/{appID}/config/login/oauth/{provider} \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"client_id": "<string>",
"client_secret": "<string>",
"type": "personal",
"enabled": true,
"scopes": [
"<string>"
],
"granted_scopes": [
"<string>"
],
"options": {
"use_email_as_identifier": true,
"allow_email_account_merge": true,
"verify_email": true
},
"apple": {
"team_id": "<string>",
"key_id": "<string>",
"p8_key": "<string>"
},
"okta": {
"issuer_url": "<string>"
}
}
'import requests
url = "https://api.prelude.dev/v2/session/apps/{appID}/config/login/oauth/{provider}"
payload = {
"client_id": "<string>",
"client_secret": "<string>",
"type": "personal",
"enabled": True,
"scopes": ["<string>"],
"granted_scopes": ["<string>"],
"options": {
"use_email_as_identifier": True,
"allow_email_account_merge": True,
"verify_email": True
},
"apple": {
"team_id": "<string>",
"key_id": "<string>",
"p8_key": "<string>"
},
"okta": { "issuer_url": "<string>" }
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
client_id: '<string>',
client_secret: '<string>',
type: 'personal',
enabled: true,
scopes: ['<string>'],
granted_scopes: ['<string>'],
options: {
use_email_as_identifier: true,
allow_email_account_merge: true,
verify_email: true
},
apple: {team_id: '<string>', key_id: '<string>', p8_key: '<string>'},
okta: {issuer_url: '<string>'}
})
};
fetch('https://api.prelude.dev/v2/session/apps/{appID}/config/login/oauth/{provider}', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.prelude.dev/v2/session/apps/{appID}/config/login/oauth/{provider}",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'client_id' => '<string>',
'client_secret' => '<string>',
'type' => 'personal',
'enabled' => true,
'scopes' => [
'<string>'
],
'granted_scopes' => [
'<string>'
],
'options' => [
'use_email_as_identifier' => true,
'allow_email_account_merge' => true,
'verify_email' => true
],
'apple' => [
'team_id' => '<string>',
'key_id' => '<string>',
'p8_key' => '<string>'
],
'okta' => [
'issuer_url' => '<string>'
]
]),
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>",
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://api.prelude.dev/v2/session/apps/{appID}/config/login/oauth/{provider}"
payload := strings.NewReader("{\n \"client_id\": \"<string>\",\n \"client_secret\": \"<string>\",\n \"type\": \"personal\",\n \"enabled\": true,\n \"scopes\": [\n \"<string>\"\n ],\n \"granted_scopes\": [\n \"<string>\"\n ],\n \"options\": {\n \"use_email_as_identifier\": true,\n \"allow_email_account_merge\": true,\n \"verify_email\": true\n },\n \"apple\": {\n \"team_id\": \"<string>\",\n \"key_id\": \"<string>\",\n \"p8_key\": \"<string>\"\n },\n \"okta\": {\n \"issuer_url\": \"<string>\"\n }\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("Authorization", "Bearer <token>")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.prelude.dev/v2/session/apps/{appID}/config/login/oauth/{provider}")
.header("Authorization", "Bearer <token>")
.header("Content-Type", "application/json")
.body("{\n \"client_id\": \"<string>\",\n \"client_secret\": \"<string>\",\n \"type\": \"personal\",\n \"enabled\": true,\n \"scopes\": [\n \"<string>\"\n ],\n \"granted_scopes\": [\n \"<string>\"\n ],\n \"options\": {\n \"use_email_as_identifier\": true,\n \"allow_email_account_merge\": true,\n \"verify_email\": true\n },\n \"apple\": {\n \"team_id\": \"<string>\",\n \"key_id\": \"<string>\",\n \"p8_key\": \"<string>\"\n },\n \"okta\": {\n \"issuer_url\": \"<string>\"\n }\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.prelude.dev/v2/session/apps/{appID}/config/login/oauth/{provider}")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n \"client_id\": \"<string>\",\n \"client_secret\": \"<string>\",\n \"type\": \"personal\",\n \"enabled\": true,\n \"scopes\": [\n \"<string>\"\n ],\n \"granted_scopes\": [\n \"<string>\"\n ],\n \"options\": {\n \"use_email_as_identifier\": true,\n \"allow_email_account_merge\": true,\n \"verify_email\": true\n },\n \"apple\": {\n \"team_id\": \"<string>\",\n \"key_id\": \"<string>\",\n \"p8_key\": \"<string>\"\n },\n \"okta\": {\n \"issuer_url\": \"<string>\"\n }\n}"
response = http.request(request)
puts response.read_body{
"config": {
"provider_id": "<string>",
"type": "personal",
"client_id": "<string>",
"enabled": true,
"scopes": [
"<string>"
],
"options": {
"use_email_as_identifier": true,
"allow_email_account_merge": true,
"verify_email": true
},
"created_at": "2023-11-07T05:31:56Z",
"updated_at": "2023-11-07T05:31:56Z",
"connection_id": "<string>",
"granted_scopes": [
"<string>"
],
"apple": {
"team_id": "<string>",
"key_id": "<string>",
"p8_key": "<string>"
},
"okta": {
"issuer_url": "<string>"
},
"enterprise": {
"issuer_url": "<string>",
"email_domain_allowlist": [
"<string>"
],
"jit_provisioning": true,
"allow_email_account_merge": true,
"enforce_login": true,
"sync_profile_on_login": true,
"default_redirect_uri": "<string>",
"claim_mapping": {
"email": "<string>",
"given_name": "<string>",
"family_name": "<string>",
"custom": {}
}
}
}
}{
"code": "invalid_request",
"status": "bad_request",
"message": "<string>"
}{
"code": "app_not_found",
"status": "not_found",
"message": "<string>"
}{
"code": "oauth_provider_already_configured",
"status": "conflict",
"message": "<string>"
}