Skip to main content

​
What LaunchKit expects from your IdP

  • An issuer that serves standard OIDC discovery at {issuer}/.well-known/openid-configuration.
  • An authorization-code client. LaunchKit always uses PKCE and validates the ID token’s nonce; the flow is server-side, so a confidential client with a secret is expected.
  • ID-token claims: email (required), given_name and family_name (used when provisioning).

​
Setup

1

Register the client in your IdP

Create a web (confidential) OIDC client. Set the redirect URI to:
Grant the standard openid, email, and profile scopes. Note the issuer URL, client ID, and client secret.
2

Create the connection in LaunchKit

In the workspace console open Workspace, then Security, choose OIDC, and enter the issuer, client ID, and client secret. Saving requires a recent re-authentication.
3

Test, then enable

Open the connection’s start URL in a fresh browser session and sign in through your IdP. Then set the connection to enabled, and optionally continue to enforcement.

​
Rotating the client secret

The stored secret is write-only: it is never displayed again after saving. To rotate it, create the new secret at your IdP and paste it into the security page; leaving the field untouched keeps the current value. Submitting an empty secret is rejected rather than silently clearing it.
As with SAML, changing the issuer, client ID, or client secret on an enforced connection automatically drops enforcement in the same save. Verify a sign-in against the new configuration, then re-enforce.