> ## Documentation Index > Fetch the complete documentation index at: https://docs.lerian.studio/llms.txt > Use this file to discover all available pages before exploring further. # Upsert SSO provider configuration > Creates or replaces the caller tenant's single active OAuth SSO provider. Upserting with the SAME type as the currently-active provider rotates its credentials/endpoints in place; a different (or absent) type replaces it, demoting and pruning the old one. Unless disablePasswordLogin is explicitly false, local password login is also disabled. The tenant is resolved from the authenticated identity, never from the payload. ## OpenAPI ````yaml /pt/openapi/v3-current/AM-identity.yaml put /v1/sso/provider openapi: 3.0.1 info: contact: {} description: This is a swagger documentation for the Identity API termsOfService: http://swagger.io/terms/ title: Identity API version: 1.0.0 servers: - url: //localhost:4001/ security: [] paths: /v1/sso/provider: put: tags: - SSO summary: Upsert SSO provider configuration description: >- Creates or replaces the caller tenant's single active OAuth SSO provider. Upserting with the SAME type as the currently-active provider rotates its credentials/endpoints in place; a different (or absent) type replaces it, demoting and pruning the old one. Unless disablePasswordLogin is explicitly false, local password login is also disabled. The tenant is resolved from the authenticated identity, never from the payload. requestBody: content: application/json: schema: $ref: '#/components/schemas/SSOProviderConfigInput' description: SSO Provider Input required: true responses: '200': content: application/json: schema: $ref: '#/components/schemas/SSOProviderConfigResponse' description: OK '400': content: application/json: schema: $ref: '#/components/schemas/pkg.HTTPError' description: Bad Request '401': content: application/json: schema: $ref: '#/components/schemas/pkg.HTTPError' description: Unauthorized '403': content: application/json: schema: $ref: '#/components/schemas/pkg.HTTPError' description: Forbidden '404': content: application/json: schema: $ref: '#/components/schemas/pkg.HTTPError' description: Not Found '500': content: application/json: schema: $ref: '#/components/schemas/pkg.HTTPError' description: Internal Server Error security: - BearerAuth: [] components: schemas: SSOProviderConfigInput: description: SSOProviderConfigInput payload example: clientId: clientId disablePasswordLogin: true issuerUrl: issuerUrl customTokenUrl: customTokenUrl domain: https://your-org.okta.com name: name clientSecret: clientSecret customUserInfoUrl: customUserInfoUrl scopes: scopes type: Google customAuthUrl: customAuthUrl properties: clientId: type: string clientSecret: description: >- #nosec G117 -- write-only credential, never echoed back in any response type: string customAuthUrl: type: string customTokenUrl: type: string customUserInfoUrl: type: string disablePasswordLogin: example: true type: boolean domain: description: >- Domain is REQUIRED for Type=Okta and ignored otherwise: Casdoor derives an Okta provider's authorize, token and userinfo endpoints from it, and no constant can stand in because they are per-org. Either the org URL (https://.okta.com) or an authorization server base (https://.okta.com/oauth2/default) is accepted; the org URL is completed to its authorization server on write. example: https://your-org.okta.com type: string issuerUrl: type: string name: type: string scopes: type: string type: enum: - Google - AzureAD - Okta - Custom example: Google type: string required: - clientId - clientSecret - type type: object SSOProviderConfigResponse: description: SSOProviderConfigResponse payload example: configured: true provider: disableSsl: true templateCode: templateCode title: title type: SendGrid content: content createdAt: '2021-09-01T00:00:00.000Z' intranetEndpoint: intranetEndpoint endpoint: endpoint appId: appId host: host customUserInfoUrl: customUserInfoUrl id: 00000000-0000-0000-0000-000000000000 clientId: clientId signName: signName method: method receiver: receiver issuerUrl: issuerUrl customTokenUrl: customTokenUrl clientId2: clientId2 customAuthUrl: customAuthUrl providerUrl: providerUrl port: 0 regionId: regionId domain: domain name: SMTP Corp subType: subType scopes: scopes category: Email passwordEnabled: true properties: configured: type: boolean passwordEnabled: type: boolean provider: $ref: '#/components/schemas/ProviderResponse' type: object pkg.HTTPError: properties: code: type: string entityType: type: string err: type: object message: type: string title: type: string type: object ProviderResponse: description: ProviderResponse payload example: disableSsl: true templateCode: templateCode title: title type: SendGrid content: content createdAt: '2021-09-01T00:00:00.000Z' intranetEndpoint: intranetEndpoint endpoint: endpoint appId: appId host: host customUserInfoUrl: customUserInfoUrl id: 00000000-0000-0000-0000-000000000000 clientId: clientId signName: signName method: method receiver: receiver issuerUrl: issuerUrl customTokenUrl: customTokenUrl clientId2: clientId2 customAuthUrl: customAuthUrl providerUrl: providerUrl port: 0 regionId: regionId domain: domain name: SMTP Corp subType: subType scopes: scopes category: Email properties: appId: type: string category: example: Email type: string clientId: type: string clientId2: type: string content: type: string createdAt: example: '2021-09-01T00:00:00.000Z' type: string customAuthUrl: type: string customTokenUrl: type: string customUserInfoUrl: type: string disableSsl: type: boolean domain: type: string endpoint: type: string host: type: string id: example: 00000000-0000-0000-0000-000000000000 type: string intranetEndpoint: type: string issuerUrl: type: string method: type: string name: example: SMTP Corp type: string port: type: integer providerUrl: type: string receiver: type: string regionId: type: string scopes: type: string signName: type: string subType: type: string templateCode: type: string title: type: string type: description: >- Type is the provider type exactly as stored in Casdoor. SMS providers created before the canonical "Twilio SMS" was adopted are still stored as "Twilio", so both values can appear here. example: SendGrid type: string type: object securitySchemes: BearerAuth: description: 'Bearer authentication. Send Authorization: Bearer .' in: header name: Authorization type: apiKey ````