> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trylaunchkit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# OIDC setup

> Connect any OpenID Connect identity provider

## What LaunchKit expects from your IdP

* An issuer that serves standard **OIDC discovery** at `{issuer}/.well-known/openid-configuration`.
* An **authorization-code** client. LaunchKit always uses **PKCE** and validates the ID token's nonce; the flow is server-side, so a confidential client with a secret is expected.
* ID-token claims: **`email`** (required), `given_name` and `family_name` (used when provisioning).

## Setup

<Steps>
  <Step title="Register the client in your IdP">
    Create a web (confidential) OIDC client. Set the redirect URI to:

    ```
    https://api.trylaunchkit.ai/auth/sso/oidc/callback
    ```

    Grant the standard `openid`, `email`, and `profile` scopes. Note the **issuer URL**, **client ID**, and **client secret**.
  </Step>

  <Step title="Create the connection in LaunchKit">
    In the workspace console open **Workspace, then Security**, choose **OIDC**, and enter the issuer, client ID, and client secret. Saving requires a recent re-authentication.
  </Step>

  <Step title="Test, then enable">
    Open the connection's **start URL** in a fresh browser session and sign in through your IdP. Then set the connection to **enabled**, and optionally continue to [enforcement](/en/sso/domains-and-enforcement).
  </Step>
</Steps>

## Rotating the client secret

The stored secret is **write-only**: it is never displayed again after saving. To rotate it, create the new secret at your IdP and paste it into the security page; leaving the field untouched keeps the current value. Submitting an empty secret is rejected rather than silently clearing it.

<Warning>
  As with SAML, changing the issuer, client ID, or client secret on an **enforced** connection automatically drops enforcement in the same save. Verify a sign-in against the new configuration, then re-enforce.
</Warning>