curl --request POST \
--url https://api.studio.prisme.ai/v2/orgs/{orgSlug}/auth/sso \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"slug": "<string>",
"config": {
"client_id": "<string>",
"authorization_endpoint": "<string>",
"token_endpoint": "<string>",
"jwks_uri": "<string>",
"client_secret": "<string>",
"scopes": [
"<string>"
],
"state": true,
"userinfo_endpoint": "<string>",
"pkce": true,
"issuer": "<string>",
"allowTokenExchange": true,
"tokenExchangeAudiences": [
"<string>"
]
}
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
slug: '<string>',
config: {
client_id: '<string>',
authorization_endpoint: '<string>',
token_endpoint: '<string>',
jwks_uri: '<string>',
client_secret: '<string>',
scopes: ['<string>'],
state: true,
userinfo_endpoint: '<string>',
pkce: true,
issuer: '<string>',
allowTokenExchange: true,
tokenExchangeAudiences: ['<string>']
}
})
};
fetch('https://api.studio.prisme.ai/v2/orgs/{orgSlug}/auth/sso', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.studio.prisme.ai/v2/orgs/{orgSlug}/auth/sso"
payload = {
"slug": "<string>",
"config": {
"client_id": "<string>",
"authorization_endpoint": "<string>",
"token_endpoint": "<string>",
"jwks_uri": "<string>",
"client_secret": "<string>",
"scopes": ["<string>"],
"state": True,
"userinfo_endpoint": "<string>",
"pkce": True,
"issuer": "<string>",
"allowTokenExchange": True,
"tokenExchangeAudiences": ["<string>"]
}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"slug": "<string>",
"type": "oidc",
"config": {
"client_id": "<string>",
"authorization_endpoint": "<string>",
"token_endpoint": "<string>",
"jwks_uri": "<string>",
"client_secret": "<string>",
"scopes": [
"<string>"
],
"state": true,
"userinfo_endpoint": "<string>",
"pkce": true,
"issuer": "<string>",
"allowTokenExchange": true,
"tokenExchangeAudiences": [
"<string>"
]
},
"id": "<string>",
"name": "<string>",
"icon": "<string>",
"attributesMapping": {
"firstName": "<string>",
"lastName": "<string>",
"email": "<string>"
},
"source": "file",
"enabled": true,
"meta": {},
"domains": [
"<string>"
],
"orgSlug": "<string>"
}{
"error": "BadParameters",
"message": "<string>",
"details": "<unknown>"
}{
"error": "AuthenticationError",
"message": "Unauthenticated"
}Create Auth Provider
Create a new SSO auth provider (super admin only)
curl --request POST \
--url https://api.studio.prisme.ai/v2/orgs/{orgSlug}/auth/sso \
--header 'Authorization: Bearer <token>' \
--header 'Content-Type: application/json' \
--data '
{
"slug": "<string>",
"config": {
"client_id": "<string>",
"authorization_endpoint": "<string>",
"token_endpoint": "<string>",
"jwks_uri": "<string>",
"client_secret": "<string>",
"scopes": [
"<string>"
],
"state": true,
"userinfo_endpoint": "<string>",
"pkce": true,
"issuer": "<string>",
"allowTokenExchange": true,
"tokenExchangeAudiences": [
"<string>"
]
}
}
'const options = {
method: 'POST',
headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
body: JSON.stringify({
slug: '<string>',
config: {
client_id: '<string>',
authorization_endpoint: '<string>',
token_endpoint: '<string>',
jwks_uri: '<string>',
client_secret: '<string>',
scopes: ['<string>'],
state: true,
userinfo_endpoint: '<string>',
pkce: true,
issuer: '<string>',
allowTokenExchange: true,
tokenExchangeAudiences: ['<string>']
}
})
};
fetch('https://api.studio.prisme.ai/v2/orgs/{orgSlug}/auth/sso', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));import requests
url = "https://api.studio.prisme.ai/v2/orgs/{orgSlug}/auth/sso"
payload = {
"slug": "<string>",
"config": {
"client_id": "<string>",
"authorization_endpoint": "<string>",
"token_endpoint": "<string>",
"jwks_uri": "<string>",
"client_secret": "<string>",
"scopes": ["<string>"],
"state": True,
"userinfo_endpoint": "<string>",
"pkce": True,
"issuer": "<string>",
"allowTokenExchange": True,
"tokenExchangeAudiences": ["<string>"]
}
}
headers = {
"Authorization": "Bearer <token>",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text){
"slug": "<string>",
"type": "oidc",
"config": {
"client_id": "<string>",
"authorization_endpoint": "<string>",
"token_endpoint": "<string>",
"jwks_uri": "<string>",
"client_secret": "<string>",
"scopes": [
"<string>"
],
"state": true,
"userinfo_endpoint": "<string>",
"pkce": true,
"issuer": "<string>",
"allowTokenExchange": true,
"tokenExchangeAudiences": [
"<string>"
]
},
"id": "<string>",
"name": "<string>",
"icon": "<string>",
"attributesMapping": {
"firstName": "<string>",
"lastName": "<string>",
"email": "<string>"
},
"source": "file",
"enabled": true,
"meta": {},
"domains": [
"<string>"
],
"orgSlug": "<string>"
}{
"error": "BadParameters",
"message": "<string>",
"details": "<unknown>"
}{
"error": "AuthenticationError",
"message": "Unauthenticated"
}Authorizations
Bearer authentication header of the form Bearer <token>, where <token> is your auth token.
Path Parameters
Organization slug
Body
Unique provider identifier (e.g. "google", "okta-saml")
Authentication protocol type
oidc, saml Provider-specific configuration (OIDC or SAML settings)
- Option 1
- Option 2
Hide child attributes
Hide child attributes
Optional OIDC userinfo endpoint. When set, it is called with the access token right after the code exchange, and its claims fill the gaps left by the id_token — for IdPs that expose profile attributes (name, email, …) only there. id_token claims always win on conflict, since only those are signature-verified. Pair with attributesMapping when the IdP uses non-standard claim names.
Expected iss claim of tokens issued by this provider. Required when allowTokenExchange is true — critical for IdPs whose jwks_uri is shared across tenants (Entra ID common, Google, …), where the iss claim is the only field discriminating our tenant from any other tenant of the same IdP.
Opt-in flag. When true, an id_token issued by this provider can be exchanged for a Prisme access token via POST /v2/login/token-exchange (no browser redirect). Defaults to false. Requires issuer to be set.
Accepted aud claim value(s) for id_tokens presented via POST /v2/login/token-exchange. Typically the client_id of the native/mobile/headless app registration(s), which is distinct from the web client_id used for the browser redirect flow. Defaults to [client_id] when omitted — matches only tokens minted for the same OAuth client as the web flow.
Display name for the provider (e.g. "Google", "Corporate SSO")
Icon URL or identifier for the provider
Where this provider is configured (read-only, returned by GET)
file, database Whether this provider is active (default true). Disabled providers are not registered as passport strategies.
Free-form metadata JSON
Associated domain names
Associated organization slug
Response
Success Response
Unique provider identifier (e.g. "google", "okta-saml")
Authentication protocol type
oidc, saml Provider-specific configuration (OIDC or SAML settings)
- Option 1
- Option 2
Hide child attributes
Hide child attributes
Optional OIDC userinfo endpoint. When set, it is called with the access token right after the code exchange, and its claims fill the gaps left by the id_token — for IdPs that expose profile attributes (name, email, …) only there. id_token claims always win on conflict, since only those are signature-verified. Pair with attributesMapping when the IdP uses non-standard claim names.
Expected iss claim of tokens issued by this provider. Required when allowTokenExchange is true — critical for IdPs whose jwks_uri is shared across tenants (Entra ID common, Google, …), where the iss claim is the only field discriminating our tenant from any other tenant of the same IdP.
Opt-in flag. When true, an id_token issued by this provider can be exchanged for a Prisme access token via POST /v2/login/token-exchange (no browser redirect). Defaults to false. Requires issuer to be set.
Accepted aud claim value(s) for id_tokens presented via POST /v2/login/token-exchange. Typically the client_id of the native/mobile/headless app registration(s), which is distinct from the web client_id used for the browser redirect flow. Defaults to [client_id] when omitted — matches only tokens minted for the same OAuth client as the web flow.
Display name for the provider (e.g. "Google", "Corporate SSO")
Icon URL or identifier for the provider
Where this provider is configured (read-only, returned by GET)
file, database Whether this provider is active (default true). Disabled providers are not registered as passport strategies.
Free-form metadata JSON
Associated domain names
Associated organization slug
Was this page helpful?