[ aws . bedrock-agentcore-control ]

create-oauth2-credential-provider

Description

Creates a new OAuth2 credential provider.

See also: AWS API Documentation

Synopsis

  create-oauth2-credential-provider
--name <value>
--credential-provider-vendor <value>
--oauth2-provider-config-input <value>
[--tags <value>]
[--cli-input-json | --cli-input-yaml]
[--generate-cli-skeleton <value>]
[--debug]
[--endpoint-url <value>]
[--no-verify-ssl]
[--no-paginate]
[--output <value>]
[--query <value>]
[--profile <value>]
[--region <value>]
[--version <value>]
[--color <value>]
[--no-sign-request]
[--ca-bundle <value>]
[--cli-read-timeout <value>]
[--cli-connect-timeout <value>]
[--cli-binary-format <value>]
[--no-cli-pager]
[--cli-auto-prompt]
[--no-cli-auto-prompt]

Options

--name (string) [required]

The name of the OAuth2 credential provider. The name must be unique within your account.

Constraints:

• min: 1
• max: 128
• pattern: [a-zA-Z0-9\-_]+

--credential-provider-vendor (string) [required]

The vendor of the OAuth2 credential provider. This specifies which OAuth2 implementation to use.

Possible values:

• GoogleOauth2
• GithubOauth2
• SlackOauth2
• SalesforceOauth2
• MicrosoftOauth2
• CustomOauth2
• AtlassianOauth2
• LinkedinOauth2
• XOauth2
• OktaOauth2
• OneLoginOauth2
• PingOneOauth2
• FacebookOauth2
• YandexOauth2
• RedditOauth2
• ZoomOauth2
• TwitchOauth2
• SpotifyOauth2
• DropboxOauth2
• NotionOauth2
• HubspotOauth2
• CyberArkOauth2
• FusionAuthOauth2
• Auth0Oauth2
• CognitoOauth2

--oauth2-provider-config-input (tagged union structure) [required]

The configuration settings for the OAuth2 provider, including client ID, client secret, and other vendor-specific settings.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: customOauth2ProviderConfig, googleOauth2ProviderConfig, githubOauth2ProviderConfig, slackOauth2ProviderConfig, salesforceOauth2ProviderConfig, microsoftOauth2ProviderConfig, atlassianOauth2ProviderConfig, linkedinOauth2ProviderConfig, includedOauth2ProviderConfig.

customOauth2ProviderConfig -> (structure)

The configuration for a custom OAuth2 provider.

oauthDiscovery -> (tagged union structure) [required]

The OAuth2 discovery information for the custom provider.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: discoveryUrl, authorizationServerMetadata.

discoveryUrl -> (string)

The discovery URL for the OAuth2 provider.

Constraints:

• pattern: .+/\.well-known/openid-configuration

authorizationServerMetadata -> (structure)

The authorization server metadata for the OAuth2 provider.

issuer -> (string) [required]

The issuer URL for the OAuth2 authorization server.

authorizationEndpoint -> (string) [required]

The authorization endpoint URL for the OAuth2 authorization server.

tokenEndpoint -> (string) [required]

The token endpoint URL for the OAuth2 authorization server.

responseTypes -> (list)

The supported response types for the OAuth2 authorization server.

(string)

tokenEndpointAuthMethods -> (list)

The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.

Constraints:

• min: 1
• max: 2

(string)

Constraints:

• pattern: (client_secret_post|client_secret_basic)

clientId -> (string) [required]

The client ID for the custom OAuth2 provider.

Constraints:

• min: 1
• max: 256

clientSecret -> (string) [required]

The client secret for the custom OAuth2 provider.

Constraints:

• min: 1
• max: 2048

googleOauth2ProviderConfig -> (structure)

The configuration for a Google OAuth2 provider.

clientId -> (string) [required]

The client ID for the Google OAuth2 provider.

Constraints:

• min: 1
• max: 256

clientSecret -> (string) [required]

The client secret for the Google OAuth2 provider.

Constraints:

• min: 1
• max: 2048

githubOauth2ProviderConfig -> (structure)

The configuration for a GitHub OAuth2 provider.

clientId -> (string) [required]

The client ID for the GitHub OAuth2 provider.

Constraints:

• min: 1
• max: 256

clientSecret -> (string) [required]

The client secret for the GitHub OAuth2 provider.

Constraints:

• min: 1
• max: 2048

slackOauth2ProviderConfig -> (structure)

The configuration for a Slack OAuth2 provider.

clientId -> (string) [required]

The client ID for the Slack OAuth2 provider.

Constraints:

• min: 1
• max: 256

clientSecret -> (string) [required]

The client secret for the Slack OAuth2 provider.

Constraints:

• min: 1
• max: 2048

salesforceOauth2ProviderConfig -> (structure)

The configuration for a Salesforce OAuth2 provider.

clientId -> (string) [required]

The client ID for the Salesforce OAuth2 provider.

Constraints:

• min: 1
• max: 256

clientSecret -> (string) [required]

The client secret for the Salesforce OAuth2 provider.

Constraints:

• min: 1
• max: 2048

microsoftOauth2ProviderConfig -> (structure)

The configuration for a Microsoft OAuth2 provider.

clientId -> (string) [required]

The client ID for the Microsoft OAuth2 provider.

Constraints:

• min: 1
• max: 256

clientSecret -> (string) [required]

The client secret for the Microsoft OAuth2 provider.

Constraints:

• min: 1
• max: 2048

tenantId -> (string)

The Microsoft Entra ID (formerly Azure AD) tenant ID for your organization. This identifies the specific tenant within Microsoft’s identity platform where your application is registered.

Constraints:

• min: 1
• max: 2048

atlassianOauth2ProviderConfig -> (structure)

Configuration settings for Atlassian OAuth2 provider integration.

clientId -> (string) [required]

The client ID for the Atlassian OAuth2 provider. This identifier is assigned by Atlassian when you register your application.

Constraints:

• min: 1
• max: 256

clientSecret -> (string) [required]

The client secret for the Atlassian OAuth2 provider. This secret is assigned by Atlassian and used along with the client ID to authenticate your application.

Constraints:

• min: 1
• max: 2048

linkedinOauth2ProviderConfig -> (structure)

Configuration settings for LinkedIn OAuth2 provider integration.

clientId -> (string) [required]

The client ID for the LinkedIn OAuth2 provider. This identifier is assigned by LinkedIn when you register your application.

Constraints:

• min: 1
• max: 256

clientSecret -> (string) [required]

The client secret for the LinkedIn OAuth2 provider. This secret is assigned by LinkedIn and used along with the client ID to authenticate your application.

Constraints:

• min: 1
• max: 2048

includedOauth2ProviderConfig -> (structure)

The configuration for a non-custom OAuth2 provider. This includes settings for supported OAuth2 providers that have built-in integration support.

clientId -> (string) [required]

The client ID for the supported OAuth2 provider. This identifier is assigned by the OAuth2 provider when you register your application.

Constraints:

• min: 1
• max: 256

clientSecret -> (string) [required]

The client secret for the supported OAuth2 provider. This secret is assigned by the OAuth2 provider and used along with the client ID to authenticate your application.

Constraints:

• min: 1
• max: 2048

issuer -> (string)

Token issuer of your isolated OAuth2 application tenant. This URL identifies the authorization server that issues tokens for this provider.

authorizationEndpoint -> (string)

OAuth2 authorization endpoint for your isolated OAuth2 application tenant. This is where users are redirected to authenticate and authorize access to their resources.

tokenEndpoint -> (string)

OAuth2 token endpoint for your isolated OAuth2 application tenant. This is where authorization codes are exchanged for access tokens.

JSON Syntax:

{
  "customOauth2ProviderConfig": {
    "oauthDiscovery": {
      "discoveryUrl": "string",
      "authorizationServerMetadata": {
        "issuer": "string",
        "authorizationEndpoint": "string",
        "tokenEndpoint": "string",
        "responseTypes": ["string", ...],
        "tokenEndpointAuthMethods": ["string", ...]
      }
    },
    "clientId": "string",
    "clientSecret": "string"
  },
  "googleOauth2ProviderConfig": {
    "clientId": "string",
    "clientSecret": "string"
  },
  "githubOauth2ProviderConfig": {
    "clientId": "string",
    "clientSecret": "string"
  },
  "slackOauth2ProviderConfig": {
    "clientId": "string",
    "clientSecret": "string"
  },
  "salesforceOauth2ProviderConfig": {
    "clientId": "string",
    "clientSecret": "string"
  },
  "microsoftOauth2ProviderConfig": {
    "clientId": "string",
    "clientSecret": "string",
    "tenantId": "string"
  },
  "atlassianOauth2ProviderConfig": {
    "clientId": "string",
    "clientSecret": "string"
  },
  "linkedinOauth2ProviderConfig": {
    "clientId": "string",
    "clientSecret": "string"
  },
  "includedOauth2ProviderConfig": {
    "clientId": "string",
    "clientSecret": "string",
    "issuer": "string",
    "authorizationEndpoint": "string",
    "tokenEndpoint": "string"
  }
}

--tags (map)

A map of tag keys and values to assign to the OAuth2 credential provider. Tags enable you to categorize your resources in different ways, for example, by purpose, owner, or environment.

Constraints:

• min: 0
• max: 50

key -> (string)

Constraints:

• min: 1
• max: 128
• pattern: [a-zA-Z0-9\s._:/=+@-]*

value -> (string)

Constraints:

• min: 0
• max: 256
• pattern: [a-zA-Z0-9\s._:/=+@-]*

Shorthand Syntax:

KeyName1=string,KeyName2=string

JSON Syntax:

{"string": "string"
  ...}

--cli-input-json | --cli-input-yaml (string) Reads arguments from the JSON string provided. The JSON string follows the format provided by --generate-cli-skeleton. If other arguments are provided on the command line, those values will override the JSON-provided values. It is not possible to pass arbitrary binary values using a JSON-provided value as the string will be taken literally. This may not be specified along with --cli-input-yaml.

--generate-cli-skeleton (string) Prints a JSON skeleton to standard output without sending an API request. If provided with no value or the value input, prints a sample input JSON that can be used as an argument for --cli-input-json. Similarly, if provided yaml-input it will print a sample input YAML that can be used with --cli-input-yaml. If provided with the value output, it validates the command inputs and returns a sample output JSON for that command. The generated JSON skeleton is not stable between versions of the AWS CLI and there are no backwards compatibility guarantees in the JSON skeleton generated.

Global Options

--debug (boolean)

Turn on debug logging.

--endpoint-url (string)

Override command’s default URL with the given URL.

--no-verify-ssl (boolean)

By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates.

--no-paginate (boolean)

Disable automatic pagination. If automatic pagination is disabled, the AWS CLI will only make one call, for the first page of results.

--output (string)

The formatting style for command output.

• json
• text
• table
• yaml
• yaml-stream

--query (string)

A JMESPath query to use in filtering the response data.

--profile (string)

Use a specific profile from your credential file.

--region (string)

The region to use. Overrides config/env settings.

--version (string)

Display the version of this tool.

--color (string)

Turn on/off color output.

• on
• off
• auto

--no-sign-request (boolean)

Do not sign requests. Credentials will not be loaded if this argument is provided.

--ca-bundle (string)

The CA certificate bundle to use when verifying SSL certificates. Overrides config/env settings.

--cli-read-timeout (int)

The maximum socket read time in seconds. If the value is set to 0, the socket read will be blocking and not timeout. The default value is 60 seconds.

--cli-connect-timeout (int)

The maximum socket connect time in seconds. If the value is set to 0, the socket connect will be blocking and not timeout. The default value is 60 seconds.

--cli-binary-format (string)

The formatting style to be used for binary blobs. The default format is base64. The base64 format expects binary blobs to be provided as a base64 encoded string. The raw-in-base64-out format preserves compatibility with AWS CLI V1 behavior and binary values must be passed literally. When providing contents from a file that map to a binary blob fileb:// will always be treated as binary and use the file contents directly regardless of the cli-binary-format setting. When using file:// the file contents will need to properly formatted for the configured cli-binary-format.

• base64
• raw-in-base64-out

--no-cli-pager (boolean)

Disable cli pager for output.

--cli-auto-prompt (boolean)

Automatically prompt for CLI input parameters.

--no-cli-auto-prompt (boolean)

Disable automatically prompt for CLI input parameters.

Output

clientSecretArn -> (structure)

The Amazon Resource Name (ARN) of the client secret in AWS Secrets Manager.

secretArn -> (string) [required]

The Amazon Resource Name (ARN) of the secret in AWS Secrets Manager.

Constraints:

• pattern: arn:(aws|aws-us-gov):secretsmanager:[A-Za-z0-9-]{1,64}:[0-9]{12}:secret:[a-zA-Z0-9-_/+=.@!]+

name -> (string)

The name of the OAuth2 credential provider.

Constraints:

• min: 1
• max: 128
• pattern: [a-zA-Z0-9\-_]+

credentialProviderArn -> (string)

The Amazon Resource Name (ARN) of the OAuth2 credential provider.

Constraints:

• pattern: arn:(aws|aws-us-gov):acps:[A-Za-z0-9-]{1,64}:[0-9]{12}:token-vault/[a-zA-Z0-9-.]+/oauth2credentialprovider/[a-zA-Z0-9-.]+

callbackUrl -> (string)

Callback URL to register on the OAuth2 credential provider as an allowed callback URL. This URL is where the OAuth2 authorization server redirects users after they complete the authorization flow.

oauth2ProviderConfigOutput -> (tagged union structure)

Contains the output configuration for an OAuth2 provider.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: customOauth2ProviderConfig, googleOauth2ProviderConfig, githubOauth2ProviderConfig, slackOauth2ProviderConfig, salesforceOauth2ProviderConfig, microsoftOauth2ProviderConfig, atlassianOauth2ProviderConfig, linkedinOauth2ProviderConfig, includedOauth2ProviderConfig.

customOauth2ProviderConfig -> (structure)

The output configuration for a custom OAuth2 provider.

oauthDiscovery -> (tagged union structure) [required]

The OAuth2 discovery information for the custom provider.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: discoveryUrl, authorizationServerMetadata.

discoveryUrl -> (string)

The discovery URL for the OAuth2 provider.

Constraints:

• pattern: .+/\.well-known/openid-configuration

authorizationServerMetadata -> (structure)

The authorization server metadata for the OAuth2 provider.

issuer -> (string) [required]

The issuer URL for the OAuth2 authorization server.

authorizationEndpoint -> (string) [required]

The authorization endpoint URL for the OAuth2 authorization server.

tokenEndpoint -> (string) [required]

The token endpoint URL for the OAuth2 authorization server.

responseTypes -> (list)

The supported response types for the OAuth2 authorization server.

(string)

tokenEndpointAuthMethods -> (list)

The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.

Constraints:

• min: 1
• max: 2

(string)

Constraints:

• pattern: (client_secret_post|client_secret_basic)

clientId -> (string)

The client ID for the custom OAuth2 provider.

Constraints:

• min: 1
• max: 256

googleOauth2ProviderConfig -> (structure)

The output configuration for a Google OAuth2 provider.

oauthDiscovery -> (tagged union structure) [required]

The OAuth2 discovery information for the Google provider.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: discoveryUrl, authorizationServerMetadata.

discoveryUrl -> (string)

The discovery URL for the OAuth2 provider.

Constraints:

• pattern: .+/\.well-known/openid-configuration

authorizationServerMetadata -> (structure)

The authorization server metadata for the OAuth2 provider.

issuer -> (string) [required]

The issuer URL for the OAuth2 authorization server.

authorizationEndpoint -> (string) [required]

The authorization endpoint URL for the OAuth2 authorization server.

tokenEndpoint -> (string) [required]

The token endpoint URL for the OAuth2 authorization server.

responseTypes -> (list)

The supported response types for the OAuth2 authorization server.

(string)

tokenEndpointAuthMethods -> (list)

The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.

Constraints:

• min: 1
• max: 2

(string)

Constraints:

• pattern: (client_secret_post|client_secret_basic)

clientId -> (string)

The client ID for the Google OAuth2 provider.

Constraints:

• min: 1
• max: 256

githubOauth2ProviderConfig -> (structure)

The output configuration for a GitHub OAuth2 provider.

oauthDiscovery -> (tagged union structure) [required]

The OAuth2 discovery information for the GitHub provider.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: discoveryUrl, authorizationServerMetadata.

discoveryUrl -> (string)

The discovery URL for the OAuth2 provider.

Constraints:

• pattern: .+/\.well-known/openid-configuration

authorizationServerMetadata -> (structure)

The authorization server metadata for the OAuth2 provider.

issuer -> (string) [required]

The issuer URL for the OAuth2 authorization server.

authorizationEndpoint -> (string) [required]

The authorization endpoint URL for the OAuth2 authorization server.

tokenEndpoint -> (string) [required]

The token endpoint URL for the OAuth2 authorization server.

responseTypes -> (list)

The supported response types for the OAuth2 authorization server.

(string)

tokenEndpointAuthMethods -> (list)

The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.

Constraints:

• min: 1
• max: 2

(string)

Constraints:

• pattern: (client_secret_post|client_secret_basic)

clientId -> (string)

The client ID for the GitHub OAuth2 provider.

Constraints:

• min: 1
• max: 256

slackOauth2ProviderConfig -> (structure)

The output configuration for a Slack OAuth2 provider.

oauthDiscovery -> (tagged union structure) [required]

The OAuth2 discovery information for the Slack provider.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: discoveryUrl, authorizationServerMetadata.

discoveryUrl -> (string)

The discovery URL for the OAuth2 provider.

Constraints:

• pattern: .+/\.well-known/openid-configuration

authorizationServerMetadata -> (structure)

The authorization server metadata for the OAuth2 provider.

issuer -> (string) [required]

The issuer URL for the OAuth2 authorization server.

authorizationEndpoint -> (string) [required]

The authorization endpoint URL for the OAuth2 authorization server.

tokenEndpoint -> (string) [required]

The token endpoint URL for the OAuth2 authorization server.

responseTypes -> (list)

The supported response types for the OAuth2 authorization server.

(string)

tokenEndpointAuthMethods -> (list)

The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.

Constraints:

• min: 1
• max: 2

(string)

Constraints:

• pattern: (client_secret_post|client_secret_basic)

clientId -> (string)

The client ID for the Slack OAuth2 provider.

Constraints:

• min: 1
• max: 256

salesforceOauth2ProviderConfig -> (structure)

The output configuration for a Salesforce OAuth2 provider.

oauthDiscovery -> (tagged union structure) [required]

The OAuth2 discovery information for the Salesforce provider.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: discoveryUrl, authorizationServerMetadata.

discoveryUrl -> (string)

The discovery URL for the OAuth2 provider.

Constraints:

• pattern: .+/\.well-known/openid-configuration

authorizationServerMetadata -> (structure)

The authorization server metadata for the OAuth2 provider.

issuer -> (string) [required]

The issuer URL for the OAuth2 authorization server.

authorizationEndpoint -> (string) [required]

The authorization endpoint URL for the OAuth2 authorization server.

tokenEndpoint -> (string) [required]

The token endpoint URL for the OAuth2 authorization server.

responseTypes -> (list)

The supported response types for the OAuth2 authorization server.

(string)

tokenEndpointAuthMethods -> (list)

The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.

Constraints:

• min: 1
• max: 2

(string)

Constraints:

• pattern: (client_secret_post|client_secret_basic)

clientId -> (string)

The client ID for the Salesforce OAuth2 provider.

Constraints:

• min: 1
• max: 256

microsoftOauth2ProviderConfig -> (structure)

The output configuration for a Microsoft OAuth2 provider.

oauthDiscovery -> (tagged union structure) [required]

The OAuth2 discovery information for the Microsoft provider.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: discoveryUrl, authorizationServerMetadata.

discoveryUrl -> (string)

The discovery URL for the OAuth2 provider.

Constraints:

• pattern: .+/\.well-known/openid-configuration

authorizationServerMetadata -> (structure)

The authorization server metadata for the OAuth2 provider.

issuer -> (string) [required]

The issuer URL for the OAuth2 authorization server.

authorizationEndpoint -> (string) [required]

The authorization endpoint URL for the OAuth2 authorization server.

tokenEndpoint -> (string) [required]

The token endpoint URL for the OAuth2 authorization server.

responseTypes -> (list)

The supported response types for the OAuth2 authorization server.

(string)

tokenEndpointAuthMethods -> (list)

The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.

Constraints:

• min: 1
• max: 2

(string)

Constraints:

• pattern: (client_secret_post|client_secret_basic)

clientId -> (string)

The client ID for the Microsoft OAuth2 provider.

Constraints:

• min: 1
• max: 256

atlassianOauth2ProviderConfig -> (structure)

The configuration details for the Atlassian OAuth2 provider.

oauthDiscovery -> (tagged union structure) [required]

Contains the discovery information for an OAuth2 provider.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: discoveryUrl, authorizationServerMetadata.

discoveryUrl -> (string)

The discovery URL for the OAuth2 provider.

Constraints:

• pattern: .+/\.well-known/openid-configuration

authorizationServerMetadata -> (structure)

The authorization server metadata for the OAuth2 provider.

issuer -> (string) [required]

The issuer URL for the OAuth2 authorization server.

authorizationEndpoint -> (string) [required]

The authorization endpoint URL for the OAuth2 authorization server.

tokenEndpoint -> (string) [required]

The token endpoint URL for the OAuth2 authorization server.

responseTypes -> (list)

The supported response types for the OAuth2 authorization server.

(string)

tokenEndpointAuthMethods -> (list)

The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.

Constraints:

• min: 1
• max: 2

(string)

Constraints:

• pattern: (client_secret_post|client_secret_basic)

clientId -> (string)

The client ID for the Atlassian OAuth2 provider.

Constraints:

• min: 1
• max: 256

linkedinOauth2ProviderConfig -> (structure)

The configuration details for the LinkedIn OAuth2 provider.

oauthDiscovery -> (tagged union structure) [required]

Contains the discovery information for an OAuth2 provider.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: discoveryUrl, authorizationServerMetadata.

discoveryUrl -> (string)

The discovery URL for the OAuth2 provider.

Constraints:

• pattern: .+/\.well-known/openid-configuration

authorizationServerMetadata -> (structure)

The authorization server metadata for the OAuth2 provider.

issuer -> (string) [required]

The issuer URL for the OAuth2 authorization server.

authorizationEndpoint -> (string) [required]

The authorization endpoint URL for the OAuth2 authorization server.

tokenEndpoint -> (string) [required]

The token endpoint URL for the OAuth2 authorization server.

responseTypes -> (list)

The supported response types for the OAuth2 authorization server.

(string)

tokenEndpointAuthMethods -> (list)

The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.

Constraints:

• min: 1
• max: 2

(string)

Constraints:

• pattern: (client_secret_post|client_secret_basic)

clientId -> (string)

The client ID for the LinkedIn OAuth2 provider.

Constraints:

• min: 1
• max: 256

includedOauth2ProviderConfig -> (structure)

The configuration for a non-custom OAuth2 provider. This includes the configuration details for supported OAuth2 providers that have built-in integration support.

oauthDiscovery -> (tagged union structure) [required]

Contains the discovery information for an OAuth2 provider.

Note

This is a Tagged Union structure. Only one of the following top level keys can be set: discoveryUrl, authorizationServerMetadata.

discoveryUrl -> (string)

The discovery URL for the OAuth2 provider.

Constraints:

• pattern: .+/\.well-known/openid-configuration

authorizationServerMetadata -> (structure)

The authorization server metadata for the OAuth2 provider.

issuer -> (string) [required]

The issuer URL for the OAuth2 authorization server.

authorizationEndpoint -> (string) [required]

The authorization endpoint URL for the OAuth2 authorization server.

tokenEndpoint -> (string) [required]

The token endpoint URL for the OAuth2 authorization server.

responseTypes -> (list)

The supported response types for the OAuth2 authorization server.

(string)

tokenEndpointAuthMethods -> (list)

The authentication methods supported by the token endpoint. This specifies how clients can authenticate when requesting tokens from the authorization server.

Constraints:

• min: 1
• max: 2

(string)

Constraints:

• pattern: (client_secret_post|client_secret_basic)

clientId -> (string)

The client ID for the supported OAuth2 provider.

Constraints:

• min: 1
• max: 256