Update enterprise OAuth connection

Update an enterprise OIDC SSO connection. The config type is immutable, and the enterprise block’s email_domain_allowlist must stay non-empty and must not overlap another connection’s.

PUT /v2/session/apps/{appID}/config/login/oauth/{provider}/{connectionID}

Update enterprise OAuth connection

cURL

curl --request PUT \
  --url https://api.prelude.dev/v2/session/apps/{appID}/config/login/oauth/{provider}/{connectionID} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "client_id": "123456789.apps.googleusercontent.com",
  "type": "enterprise",
  "client_secret": "GOCSPX-abc123def456",
  "enabled": true,
  "scopes": [
    "openid"
  ],
  "granted_scopes": [
    "prld:pwd:write"
  ],
  "options": {
    "use_email_as_identifier": true,
    "allow_email_account_merge": false,
    "verify_email": false
  },
  "apple": {
    "team_id": "ABCDEF1234",
    "key_id": "KEY123456",
    "p8_key": "-----BEGIN PRIVATE KEY-----\nMIGT...base64...==\n-----END PRIVATE KEY-----"
  },
  "okta": {
    "issuer_url": "https://dev-123456.okta.com/oauth2/default"
  }
}
'

200

{
  "config": {
    "provider_id": "google",
    "type": "enterprise",
    "client_id": "123456789.apps.googleusercontent.com",
    "enabled": true,
    "scopes": [
      "openid"
    ],
    "options": {
      "use_email_as_identifier": true,
      "allow_email_account_merge": false,
      "verify_email": false
    },
    "created_at": "2025-03-15T10:30:00Z",
    "updated_at": "2025-03-15T12:00:00Z",
    "connection_id": "ocon_01jqebhswje1ka1z7ahr9rfsgt",
    "granted_scopes": [
      "prld:pwd:write"
    ],
    "apple": {
      "team_id": "ABCDEF1234",
      "key_id": "KEY123456",
      "p8_key": "-----BEGIN PRIVATE KEY-----\nMIGT...base64...==\n-----END PRIVATE KEY-----"
    },
    "okta": {
      "issuer_url": "https://dev-123456.okta.com/oauth2/default"
    },
    "enterprise": {
      "issuer_url": "https://acme.okta.com/oauth2/default",
      "email_domain_allowlist": [
        "acme.com"
      ],
      "jit_provisioning": true,
      "allow_email_account_merge": true,
      "enforce_login": false,
      "sync_profile_on_login": true,
      "default_redirect_uri": "https://acme.yourapp.com/callback",
      "claim_mapping": {
        "email": "email",
        "given_name": "given_name",
        "family_name": "family_name",
        "custom": {}
      }
    }
  }
}

Authorizations

Authorization · string · header · required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

appID · string · required

The id of the app the request refers to. An application's unique identifier.

Examples:

"54e9ujn"

"fvua38g"

provider · string · required

The OAuth provider identifier.

Examples:

"google"

"apple"

"github"

"microsoft"

"okta"

"facebook"

"linkedin"

connectionID · string · required

The enterprise OAuth connection identifier (prefixed with ocon_).

Example:

"ocon_01jqebhswje1ka1z7ahr9rfsgt"

Body

application/json

client_id · string · required

Example:

"123456789.apps.googleusercontent.com"

type · enum<string> · default: personal

personal is the classic social-login config (at most one per provider, addressed as …/oauth/{provider}). enterprise is a per-connection OIDC SSO config (any number per provider, addressed as …/oauth/{provider}/{connectionID}). Defaults to personal.

Available options: personal, enterprise

Example:

"enterprise"

client_secret · string

Example:

"GOCSPX-abc123def456"

enabled · boolean

Example:

true

scopes · string[]

Scopes requested from the OAuth provider (IdP).

granted_scopes · string[]

Prelude session scopes attached to the session when a login completes through this social provider (for example prld:pwd:write). Distinct from scopes, which are requested from the IdP.

Example:

["prld:pwd:write"]

options · object

Show child attributes

apple · object

Show child attributes

okta · object

Show child attributes

enterprise · object

Required when type is enterprise. The config type is immutable across updates.

Show child attributes

Response

200

application/json

OK

config · object · required

Show child attributes