Create OIDC provider

Part of OIDC Federation. Registration is org-level and root-quorum-only — it establishes trust in an (issuer, audiences) pair for the whole (parent) organization, not a single user. The issuer’s discovery document and JWKS are fetched live over HTTPS (full public-CA validation, no dev bypass) the first time a token from it is actually verified; registration itself does not perform that fetch.

type

enum<string>

required

Enum options: ACTIVITY_TYPE_CREATE_OIDC_PROVIDER

timestampMs

string

required

Timestamp (in milliseconds) of the request, used to verify liveness of user requests.

organizationId

string

required

Unique identifier for a given Organization.

parameters

object

required

The parameters object containing the specific intent data for this activity.

Show details

parameters.audiences

array

required

Allowed OAuth2 audiences (client IDs) for tokens from this issuer. At least one is required — an empty list is rejected (fail-closed: no wildcard trust).

generateAppProofs

boolean

Enable to have your activity generate and return App Proofs, enabling verifiability.

A successful response returns the following fields:

activity

object

required

The activity object containing type, intent, and result

Show activity details

curl --request POST \
  --url https://api.0xkey.io/public/v1/submit/create_oidc_provider \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --header "X-Stamp: <string> (see Authorizations — root-quorum signature required)" \
  --data '{
    "type": "ACTIVITY_TYPE_CREATE_OIDC_PROVIDER",
    "timestampMs": "<string> (e.g. 1746736509954)",
    "organizationId": "<string> (Your parent Organization ID)",
    "parameters": {
        "providerName": "<string> (e.g. Acme Corp IdP)",
        "issuer": "<string> (e.g. https://auth.acme.com)",
        "audiences": ["<string> (your OAuth2 client ID)"]
    }
}'

import { ZeroXKey } from "@0xkey-io/sdk-server";

const zeroXKey = new ZeroXKey({
  apiBaseUrl: "https://api.0xkey.io",
  apiPublicKey: process.env.API_PUBLIC_KEY!,
  apiPrivateKey: process.env.API_PRIVATE_KEY!,
  defaultOrganizationId: process.env.ORGANIZATION_ID!,
});

const response = await zeroXKey.apiClient().createOidcProvider({
  providerName: "<string> (e.g. Acme Corp IdP)",
  issuer: "<string> (e.g. https://auth.acme.com)",
  audiences: ["<string> (your OAuth2 client ID)"],
});

{
  "activity": {
    "id": "<activity-id>",
    "status": "ACTIVITY_STATUS_COMPLETED",
    "type": "ACTIVITY_TYPE_CREATE_OIDC_PROVIDER",
    "organizationId": "<organization-id>",
    "timestampMs": "<timestamp> (e.g. 1746736509954)",
    "result": {
      "createOidcProviderResult": {
        "providerId": "<string>"
      }
    },
    "votes": "<array>",
    "fingerprint": "<string>",
    "canApprove": "<boolean>",
    "canReject": "<boolean>",
    "createdAt": "<string>",
    "updatedAt": "<string>"
  }
}

curl --request POST \
  --url https://api.0xkey.io/public/v1/submit/create_oidc_provider \
  --header 'Accept: application/json' \
  --header 'Content-Type: application/json' \
  --header "X-Stamp: <string> (see Authorizations — root-quorum signature required)" \
  --data '{
    "type": "ACTIVITY_TYPE_CREATE_OIDC_PROVIDER",
    "timestampMs": "<string> (e.g. 1746736509954)",
    "organizationId": "<string> (Your parent Organization ID)",
    "parameters": {
        "providerName": "<string> (e.g. Acme Corp IdP)",
        "issuer": "<string> (e.g. https://auth.acme.com)",
        "audiences": ["<string> (your OAuth2 client ID)"]
    }
}'

import { ZeroXKey } from "@0xkey-io/sdk-server";

const zeroXKey = new ZeroXKey({
  apiBaseUrl: "https://api.0xkey.io",
  apiPublicKey: process.env.API_PUBLIC_KEY!,
  apiPrivateKey: process.env.API_PRIVATE_KEY!,
  defaultOrganizationId: process.env.ORGANIZATION_ID!,
});

const response = await zeroXKey.apiClient().createOidcProvider({
  providerName: "<string> (e.g. Acme Corp IdP)",
  issuer: "<string> (e.g. https://auth.acme.com)",
  audiences: ["<string> (your OAuth2 client ID)"],
});

{
  "activity": {
    "id": "<activity-id>",
    "status": "ACTIVITY_STATUS_COMPLETED",
    "type": "ACTIVITY_TYPE_CREATE_OIDC_PROVIDER",
    "organizationId": "<organization-id>",
    "timestampMs": "<timestamp> (e.g. 1746736509954)",
    "result": {
      "createOidcProviderResult": {
        "providerId": "<string>"
      }
    },
    "votes": "<array>",
    "fingerprint": "<string>",
    "canApprove": "<boolean>",
    "canReject": "<boolean>",
    "createdAt": "<string>",
    "updatedAt": "<string>"
  }
}

Webhooks

Public API

Create OIDC provider