---
title: "Configure OIDC SSO"
source_url: https://dev.digicert.com/certcentral-apis/services-api/account/configure-oidc-sso.html
api_method: POST
api_endpoint: "/services/v2/sso/oidc/entity"
api_url: "https://www.digicert.com/services/v2/sso/oidc/entity"
---

**POST** `https://www.digicert.com/services/v2/sso/oidc/entity`

Use this endpoint to set up single sign-on with your Identity Provider (IdP) using OpenID Connect (OIDC).

## Prerequisites

Before using this endpoint, make sure you have access to and are familiar with your company's Identity Provider (IdP), such as PingOne or Okta. You need:

- Permission to set up OIDC SSO for an application (CertCentral) in your IdP.
- Access to the provider URL, client ID, and client secret for your OIDC service.

## Example requests and responses

## cURL

```bash
curl --request POST 'https://www.digicert.com/services/v2/sso/oidc/entity' \
--header 'X-DC-DEVKEY: {{api_key}}' \
--header 'Content-Type: application/json' \
--data-raw '{
    "provider_url": "https://provider.example.com/",
    "client_id": "client_id",
    "client_secret": "client_secret",
    "friendly_name": "Public Friendly Name",
    "scope_parameter": "preferred_username",
    "discoverable": true
}'
```

## 201 Created

```console
// No content
```

## Request parameters

<table class="params-table">
<thead>
<tr>
<th>Name</th>
<th>Req/Opt</th>
<th>Type</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>provider_url</td>
<td>required</td>
<td>string</td>
<td>URL for your Identity Provider (IdP). Get this value from your IdP service.</td>
</tr>
<tr>
<td>client_id</td>
<td>required</td>
<td>string</td>
<td>Client ID from your IdP that CertCentral can use to identify itself in requests to your OIDC service.</td>
</tr>
<tr>
<td>client_secret</td>
<td>required</td>
<td>string</td>
<td>Password from your IdP that CertCentral can use to authenticate requests to your OIDC service.</td>
</tr>
<tr>
<td>friendly_name</td>
<td>required</td>
<td>string</td>
<td>Custom SSO provider friendly name. If <code>discoverable</code> is true, this friendly name is visible to anyone who visits DigiCert's public SSO login pages.</td>
</tr>
<tr>
<td>scope_parameter</td>
<td>required</td>
<td>string</td>
<td>ID token claim attribute to match with the username.<br><strong>Allowed values:</strong><br><ul><li><code>email</code>: Email</li><li><code>sub</code>: Subject</li><li><code>preferred_username</code>: Preferred username</li><li><code>username</code>: Username</li></ul></td>
</tr>
<tr>
<td>discoverable</td>
<td>optional</td>
<td>boolean</td>
<td>If true, your provider friendly name appears in the list of IdPs for anyone who visits DigiCert's public SSO pages.<br><strong>Default:</strong> false</td>
</tr>
</tbody>
</table>

## Errors

<table>
<thead>
<tr>
<th>Status</th>
<th>Code</th>
<th>Description</th>
</tr>
</thead>
<tbody>
<tr>
<td>400</td>
<td>invalid_value|provider_url</td>
<td>The provider URL is invalid. Make sure you have the correct provider URL and try again. You can get the provider URL for your OIDC service from your IdP.</td>
</tr>
<tr>
<td>400</td>
<td>friendly_name_exists_already</td>
<td>The friendly name already exists. Choose a unique friendly name and try again.</td>
</tr>
<tr>
<td>400</td>
<td>invalid_value|scope_parameter</td>
<td>The ID token claim attribute is invalid. Use one of these allowed values:<br><ul><li><code>email</code></li><li><code>sub</code></li><li><code>preferred_username</code></li><li><code>username</code></li></ul></td>
</tr>
</tbody>
</table>