Identity Providers
An Identity Provider (IDP) represents an external OAuth 2.0 provider — such as Google, Microsoft, or Salesforce — that Koodisi uses to authenticate and authorize connections to external services.
IDPs are the foundation of Koodisi's external service integration system. Once configured, an IDP can be referenced by one or more Resource Templates to define reusable service blueprints.
Location: Library > My Artifacts > ID Providers
What You Can Do
| Action | Description |
|---|---|
| Create | Set up a new IDP via a 3-step wizard |
| Edit | Modify an existing IDP's configuration |
| View | Inspect IDP details in read-only mode |
| Delete | Permanently remove an IDP |
| Search | Filter IDPs by name |
Creating an Identity Provider
Navigate to Library > My Artifacts > ID Providers and click Create. The wizard walks you through three steps.
Step 1 — Basic Details
| Field | Required | Description |
|---|---|---|
| Name | Required | A unique identifier for the IDP across your organization. Validated in real time as you type. |
| Description | Optional | A markdown-supported description of the provider's purpose. |
| Icon | Optional | Pick from the icon library or upload a custom SVG file. |
| Grant Types | Required | Select one or both OAuth 2.0 flows the provider supports (see below). |
| Allow Multi-Tenant | Optional | Enables context-based (per-tenant) credential resolution at runtime. |
| Allow Default Connection | Optional | Enables platform-level shared credentials that are pre-filled into Resource Templates. |
Grant Types
| Grant Type | When to Use |
|---|---|
| Authorization Code | User-facing login flows — the user is redirected to the provider's login page to authorize access. |
| Client Credentials | Server-to-server integrations — no user interaction required; the platform authenticates using a client ID and secret. |
You can select both grant types if the IDP supports both flows.
Step 2 — Configuration
Environments
An IDP can be configured for multiple deployment environments (e.g., Development, Production). Each environment holds its own set of OAuth endpoints.
Click Add Environment to configure one or more environments:
| Field | Required | Description |
|---|---|---|
| Environment Name | Required | A label for this environment (e.g., dev, prod). |
| Physical Environment | Optional | Maps to Development or Production. |
| Authorization URL | Required | The provider's OAuth authorization endpoint. |
| Token URL | Required | The endpoint used to exchange authorization codes or client credentials for access tokens. |
| Revoke URL | Optional | The endpoint used to revoke tokens. |
| User Info URL | Optional | The endpoint to retrieve authenticated user profile details. |
| OpenID Config URL | Optional | If the provider supports OpenID Connect, entering this URL auto-populates the Authorization, Token, Revoke, and User Info URLs. |
| Default Environment | Optional | Mark one environment as the default. It is used when no specific environment is specified at runtime. |
If your provider exposes an OpenID Connect discovery document (.well-known/openid-configuration), enter that URL first — Koodisi will auto-fetch and fill all endpoint URLs for you.
Advanced Options
Advanced Options let you attach extra parameters to OAuth requests. These are useful when a provider requires non-standard query parameters, body fields, or headers.
You can add advanced options at the IDP level (applied globally to all environments) or at the per-environment level.
| Field | Description |
|---|---|
| Request Type | Where this parameter is applied: AUTH_REQUEST (authorization endpoint), TOKEN_REQUEST (token endpoint), or REFRESH_REQUEST (token refresh). |
| Key | The parameter name. |
| Value | The parameter value. |
| Send In Body | Include the parameter in the POST request body. |
| Send In URL | Append the parameter as a URL query string. |
| Send In Headers | Include the parameter as an HTTP header. |
| Can Override | Allow Resource Template or Managed Resource configurations to override this value. |
Step 3 — Review
Review all settings before saving. Click Back to make changes or Save to create the IDP.
Once saved, the IDP is immediately available for use when creating Resource Templates across your organization.
OAuth Redirect URL
Koodisi provides a platform-managed OAuth Redirect URL (also called a callback URL). When configuring your OAuth application on the provider's side (e.g., in the Google Cloud Console or Salesforce Connected App settings), register this URL as an allowed redirect URI.
You can copy the redirect URL from the IDP creation form using the copy-to-clipboard button.
Editing an Identity Provider
- Navigate to Library > My Artifacts > ID Providers.
- Locate the IDP you want to modify.
- Click the Edit (pencil) icon.
- Update the relevant fields and click Save.
Editing an IDP does not affect existing Resource Templates or Managed Resources that reference it, but credential behavior may change if endpoint URLs are updated.
Deleting an Identity Provider
- Navigate to Library > My Artifacts > ID Providers.
- Click the Delete (trash) icon next to the IDP.
- Confirm the deletion in the dialog.
Deleting an IDP will impact any Resource Templates linked to it. Ensure no active Managed Resources depend on this IDP before deleting.
What's Next
After setting up an IDP, create a Resource Template to define the scopes and credentials a specific service integration needs.