> For the complete documentation index, see [llms.txt](https://docs.n8n.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.n8n.io/connect/n8n-api/settings-sso-oidc.md).
# Settings Sso Oidc
Operations about OIDC SSO settings
## Retrieve the OIDC SSO configuration
> Retrieve the current OIDC SSO configuration, including every field exposed in the UI. The client secret is redacted on read and is never echoed back in plaintext. Requires the \`oidc:manage\` scope and the OIDC feature to be licensed.
```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"SettingsSsoOidc","description":"Operations about OIDC SSO settings"}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]},{"CookieAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"CookieAuth":{"type":"apiKey","in":"cookie","name":"n8n-auth"}},"schemas":{"oidc-configuration":{"type":"object","additionalProperties":false,"required":["clientId","clientSecret","discoveryEndpoint","loginEnabled","prompt","authenticationContextClassReference","additionalScopes","emailVerifiedRequired","rpInitiatedLogoutEnabled"],"properties":{"clientId":{"type":"string","description":"The client ID issued when registering n8n with the OIDC provider."},"clientSecret":{"type":"string","description":"The client secret issued when registering n8n with the OIDC provider. Redacted on read when set; never echoed back in plaintext.\n"},"discoveryEndpoint":{"type":"string","format":"uri","description":"The OIDC provider's well-known discovery endpoint."},"loginEnabled":{"type":"boolean","description":"Whether OIDC single sign-on is enabled."},"prompt":{"type":"string","enum":["none","login","consent","select_account","create"],"description":"The prompt parameter to use when authenticating with the OIDC provider."},"authenticationContextClassReference":{"type":"array","items":{"type":"string"},"description":"ACR values to include in the authorization request (acr_values parameter), in order of preference.\n"},"additionalScopes":{"type":"string","description":"Additional scopes to request, space separated. n8n always requests `openid`, `profile` and `email`.\n"},"emailVerifiedRequired":{"type":"boolean","description":"Whether the identity provider must assert that the user's email address is verified before the login is accepted. When disabled, only an explicit negative assertion is rejected.\n"},"rpInitiatedLogoutEnabled":{"type":"boolean","description":"Whether signing out of n8n also ends the session at the OIDC provider via RP-Initiated Logout. When disabled, sign-out is local to n8n only.\n"}}}},"responses":{"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"}}},"paths":{"/settings/sso/oidc":{"get":{"tags":["SettingsSsoOidc"],"summary":"Retrieve the OIDC SSO configuration","description":"Retrieve the current OIDC SSO configuration, including every field exposed in the UI. The client secret is redacted on read and is never echoed back in plaintext. Requires the `oidc:manage` scope and the OIDC feature to be licensed.\n","responses":{"200":{"description":"Operation successful.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/oidc-configuration"}}}},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"}}}}}}
```
## Set the OIDC SSO configuration
> Set the OIDC SSO configuration. The update takes effect exactly as it would from the UI, using the same validation. \`clientId\`, \`clientSecret\` and \`discoveryEndpoint\` are required; submit the redacted client secret sentinel to keep the stored secret unchanged. Requires the \`oidc:manage\` scope and the OIDC feature to be licensed. The client secret is redacted in the response. When the configuration is managed declaratively (via environment variables), the write is rejected with 409 and no changes are made.
```json
{"openapi":"3.0.0","info":{"title":"n8n Public API","version":"1.1.1"},"tags":[{"name":"SettingsSsoOidc","description":"Operations about OIDC SSO settings"}],"servers":[{"url":"/api/v1","description":"Current n8n instance (self-hosted built-in playground)"},{"url":"{url}/api/v1","description":"Self-hosted n8n instance","variables":{"url":{"default":"https://example.com"}}}],"security":[{"ApiKeyAuth":[]},{"BearerAuth":[]},{"CookieAuth":[]}],"components":{"securitySchemes":{"ApiKeyAuth":{"type":"apiKey","in":"header","name":"X-N8N-API-KEY"},"BearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"JWT"},"CookieAuth":{"type":"apiKey","in":"cookie","name":"n8n-auth"}},"schemas":{"oidc-configuration.update":{"type":"object","additionalProperties":false,"description":"Full OIDC SSO configuration to set. This is a full replacement: every writable field must be provided. Partial updates are rejected. Submit the redacted secret sentinel for `clientSecret` to keep the stored secret unchanged.\n","required":["clientId","clientSecret","discoveryEndpoint","loginEnabled","prompt","authenticationContextClassReference","additionalScopes","emailVerifiedRequired","rpInitiatedLogoutEnabled"],"properties":{"clientId":{"type":"string","minLength":1,"description":"The client ID issued when registering n8n with the OIDC provider."},"clientSecret":{"type":"string","minLength":1,"description":"The client secret issued when registering n8n with the OIDC provider. Submit the redacted sentinel value returned on read to keep the stored secret unchanged.\n"},"discoveryEndpoint":{"type":"string","format":"uri","description":"The OIDC provider's well-known discovery endpoint."},"loginEnabled":{"type":"boolean","description":"Whether OIDC single sign-on is enabled."},"prompt":{"type":"string","enum":["none","login","consent","select_account","create"],"description":"The prompt parameter to use when authenticating."},"authenticationContextClassReference":{"type":"array","items":{"type":"string"},"description":"ACR values to include in the authorization request (acr_values parameter), in order of preference. Use an empty array when unused.\n"},"additionalScopes":{"type":"string","description":"Additional scopes to request, space separated. n8n always requests `openid`, `profile` and `email`. Use an empty string when unused.\n"},"emailVerifiedRequired":{"type":"boolean","description":"Whether the identity provider must assert that the user's email address is verified before the login is accepted. When disabled, only an explicit negative assertion is rejected.\n"},"rpInitiatedLogoutEnabled":{"type":"boolean","description":"Whether signing out of n8n also ends the session at the OIDC provider via RP-Initiated Logout. When disabled, sign-out is local to n8n only.\n"}}},"oidc-configuration":{"type":"object","additionalProperties":false,"required":["clientId","clientSecret","discoveryEndpoint","loginEnabled","prompt","authenticationContextClassReference","additionalScopes","emailVerifiedRequired","rpInitiatedLogoutEnabled"],"properties":{"clientId":{"type":"string","description":"The client ID issued when registering n8n with the OIDC provider."},"clientSecret":{"type":"string","description":"The client secret issued when registering n8n with the OIDC provider. Redacted on read when set; never echoed back in plaintext.\n"},"discoveryEndpoint":{"type":"string","format":"uri","description":"The OIDC provider's well-known discovery endpoint."},"loginEnabled":{"type":"boolean","description":"Whether OIDC single sign-on is enabled."},"prompt":{"type":"string","enum":["none","login","consent","select_account","create"],"description":"The prompt parameter to use when authenticating with the OIDC provider."},"authenticationContextClassReference":{"type":"array","items":{"type":"string"},"description":"ACR values to include in the authorization request (acr_values parameter), in order of preference.\n"},"additionalScopes":{"type":"string","description":"Additional scopes to request, space separated. n8n always requests `openid`, `profile` and `email`.\n"},"emailVerifiedRequired":{"type":"boolean","description":"Whether the identity provider must assert that the user's email address is verified before the login is accepted. When disabled, only an explicit negative assertion is rejected.\n"},"rpInitiatedLogoutEnabled":{"type":"boolean","description":"Whether signing out of n8n also ends the session at the OIDC provider via RP-Initiated Logout. When disabled, sign-out is local to n8n only.\n"}}}},"responses":{"badRequest":{"description":"The request is invalid or provides malformed data."},"unauthorized":{"description":"Unauthorized"},"forbidden":{"description":"Forbidden"},"conflict":{"description":"Conflict"}}},"paths":{"/settings/sso/oidc":{"put":{"tags":["SettingsSsoOidc"],"summary":"Set the OIDC SSO configuration","description":"Set the OIDC SSO configuration. The update takes effect exactly as it would from the UI, using the same validation. `clientId`, `clientSecret` and `discoveryEndpoint` are required; submit the redacted client secret sentinel to keep the stored secret unchanged. Requires the `oidc:manage` scope and the OIDC feature to be licensed. The client secret is redacted in the response. When the configuration is managed declaratively (via environment variables), the write is rejected with 409 and no changes are made.\n","requestBody":{"description":"The OIDC SSO configuration to set.","required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/oidc-configuration.update"}}}},"responses":{"200":{"description":"Operation successful.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/oidc-configuration"}}}},"400":{"$ref":"#/components/responses/badRequest"},"401":{"$ref":"#/components/responses/unauthorized"},"403":{"$ref":"#/components/responses/forbidden"},"409":{"$ref":"#/components/responses/conflict"}}}}}}
```