> ## Documentation Index
> Fetch the complete documentation index at: https://docs.api.ignitehealth.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure OIDC

> Exchange OIDC settings and register Ignite with your identity provider.

Ignite must register your connection before OIDC sign-in can be tested.

Ignite uses the OIDC authorization code flow with PKCE enabled by default. For the documented secret-based setup, register a confidential web client. Start with [SSO setup](https://docs.api.ignitehealth.com/sso-setup.md) for the sandbox and production URLs and the `providerId` assigned to your connection.

## Connection handoff

Exchange these details for each environment. You can create the IdP client to obtain its client ID first. Wait for Ignite's exact redirect URI and settings before completing its registration.

### You provide Ignite

* OIDC as the protocol and the target environment (sandbox or production).
* IdP issuer and discovery URL, and the client ID assigned to Ignite for this environment.
* Client secret through an agreed secure channel.
* Proposed mapping for the user's email claim, including whether it comes from the ID token or UserInfo.
* The scopes your IdP requires to release that claim.
* IdP test identities for sign-in and access testing.

### Ignite confirms before you complete IdP registration

* The connection's `providerId`, confirmed browser launch URL, and exact OIDC redirect URI.
* The token endpoint client authentication method for this connection: `client_secret_basic` or `client_secret_post`.
* The exact scopes Ignite will request, including `openid` and any scopes needed for the agreed email claim.
* Whether PKCE is enabled for this connection.
* The agreed email mapping, mapped test identities and invitations, and that this environment is ready for testing.

The client authentication method specifies how Ignite sends its client ID and secret when exchanging an authorization code at your IdP's token endpoint: `client_secret_basic` uses an HTTP Basic authorization header. `client_secret_post` sends them in the request body. Configure the IdP client to accept the method Ignite confirms.

## Identity claims

| Claim | Behavior |
| - | - |
| `sub` | Stable OIDC subject used to link repeat sign-ins to the same identity. |
| `email` | Nonempty email is required by the default mapping for first sign-in. |

Ignite reads UserInfo when configured, otherwise the ID token. When UserInfo is used, its `sub` must match the ID token's `sub`.

First sign-in also depends on [Ignite account and invitation access](https://docs.api.ignitehealth.com/sso-access.md). A valid IdP response alone does not grant access.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.