Settings Sso Oidc

Operations about OIDC SSO settings

Retrieve the OIDC SSO configuration

get

/settings/sso/oidc

Retrieve the current OIDC SSO configuration, including every field exposed in the UI. The client secret is redacted on read and is never echoed back in plaintext. Requires the oidc:manage scope and the OIDC feature to be licensed.

Authorizations

X-N8N-API-KEYstringRequired

Responses

200

Operation successful.

application/json

clientIdstringRequired

The client ID issued when registering n8n with the OIDC provider.

Example: n8n-client

clientSecretstringRequired

The client secret issued when registering n8n with the OIDC provider. Redacted on read when set; never echoed back in plaintext.

Example: **hidden**

discoveryEndpointstring · uriRequired

The OIDC provider's well-known discovery endpoint.

Example: https://accounts.google.com/.well-known/openid-configuration

loginEnabledbooleanRequired

Whether OIDC single sign-on is enabled.

Example: false

promptstring · enumRequired

The prompt parameter to use when authenticating with the OIDC provider.

Example: select_accountPossible values:

authenticationContextClassReferencestring[]Required

ACR values to include in the authorization request (acr_values parameter), in order of preference.

Example: ["mfa","pwd"]

additionalScopesstringRequired

Additional scopes to request, space separated. n8n always requests openid, profile and email.

Example: groups roles

emailVerifiedRequiredbooleanRequired

Whether the identity provider must assert that the user's email address is verified before the login is accepted. When disabled, only an explicit negative assertion is rejected.

Example: false

rpInitiatedLogoutEnabledbooleanRequired

Whether signing out of n8n also ends the session at the OIDC provider via RP-Initiated Logout. When disabled, sign-out is local to n8n only.

Example: false

401

Unauthorized

403

Forbidden

get/settings/sso/oidc

GET /api/v1/settings/sso/oidc HTTP/1.1
X-N8N-API-KEY: YOUR_API_KEY
Accept: */*

{
  "clientId": "n8n-client",
  "clientSecret": "**hidden**",
  "discoveryEndpoint": "https://accounts.google.com/.well-known/openid-configuration",
  "loginEnabled": false,
  "prompt": "select_account",
  "authenticationContextClassReference": [
    "mfa",
    "pwd"
  ],
  "additionalScopes": "groups roles",
  "emailVerifiedRequired": false,
  "rpInitiatedLogoutEnabled": false
}

Set the OIDC SSO configuration

put

/settings/sso/oidc

Set the OIDC SSO configuration. The update takes effect exactly as it would from the UI, using the same validation. clientId, clientSecret and discoveryEndpoint are required; submit the redacted client secret sentinel to keep the stored secret unchanged. Requires the oidc:manage scope and the OIDC feature to be licensed. The client secret is redacted in the response. When the configuration is managed declaratively (via environment variables), the write is rejected with 409 and no changes are made.

Authorizations

X-N8N-API-KEYstringRequired

Body

Full OIDC SSO configuration to set. This is a full replacement: every writable field must be provided. Partial updates are rejected. Submit the redacted secret sentinel for clientSecret to keep the stored secret unchanged.

clientIdstring · min: 1Required

The client ID issued when registering n8n with the OIDC provider.

Example: n8n-client

clientSecretstring · min: 1Required

The client secret issued when registering n8n with the OIDC provider. Submit the redacted sentinel value returned on read to keep the stored secret unchanged.

Example: my-client-secret

discoveryEndpointstring · uriRequired

The OIDC provider's well-known discovery endpoint.

Example: https://accounts.google.com/.well-known/openid-configuration

loginEnabledbooleanRequired

Whether OIDC single sign-on is enabled.

Example: false

promptstring · enumRequired

The prompt parameter to use when authenticating.

Example: select_accountPossible values:

authenticationContextClassReferencestring[]Required

ACR values to include in the authorization request (acr_values parameter), in order of preference. Use an empty array when unused.

Example: ["mfa","pwd"]

additionalScopesstringRequired

Additional scopes to request, space separated. n8n always requests openid, profile and email. Use an empty string when unused.

Example: groups roles

emailVerifiedRequiredbooleanRequired

Whether the identity provider must assert that the user's email address is verified before the login is accepted. When disabled, only an explicit negative assertion is rejected.

Example: false

rpInitiatedLogoutEnabledbooleanRequired

Whether signing out of n8n also ends the session at the OIDC provider via RP-Initiated Logout. When disabled, sign-out is local to n8n only.

Example: false

Responses

200

Operation successful.

application/json

clientIdstringRequired

The client ID issued when registering n8n with the OIDC provider.

Example: n8n-client

clientSecretstringRequired

The client secret issued when registering n8n with the OIDC provider. Redacted on read when set; never echoed back in plaintext.

Example: **hidden**

discoveryEndpointstring · uriRequired

The OIDC provider's well-known discovery endpoint.

Example: https://accounts.google.com/.well-known/openid-configuration

loginEnabledbooleanRequired

Whether OIDC single sign-on is enabled.

Example: false

promptstring · enumRequired

The prompt parameter to use when authenticating with the OIDC provider.

Example: select_accountPossible values:

authenticationContextClassReferencestring[]Required

ACR values to include in the authorization request (acr_values parameter), in order of preference.

Example: ["mfa","pwd"]

additionalScopesstringRequired

Additional scopes to request, space separated. n8n always requests openid, profile and email.

Example: groups roles

emailVerifiedRequiredbooleanRequired

Whether the identity provider must assert that the user's email address is verified before the login is accepted. When disabled, only an explicit negative assertion is rejected.

Example: false

rpInitiatedLogoutEnabledbooleanRequired

Whether signing out of n8n also ends the session at the OIDC provider via RP-Initiated Logout. When disabled, sign-out is local to n8n only.

Example: false

400

The request is invalid or provides malformed data.

401

Unauthorized

403

Forbidden

409

Conflict

put/settings/sso/oidc

PUT /api/v1/settings/sso/oidc HTTP/1.1
X-N8N-API-KEY: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 338

{
  "clientId": "n8n-client",
  "clientSecret": "my-client-secret",
  "discoveryEndpoint": "https://accounts.google.com/.well-known/openid-configuration",
  "loginEnabled": false,
  "prompt": "select_account",
  "authenticationContextClassReference": [
    "mfa",
    "pwd"
  ],
  "additionalScopes": "groups roles",
  "emailVerifiedRequired": false,
  "rpInitiatedLogoutEnabled": false
}

{
  "clientId": "n8n-client",
  "clientSecret": "**hidden**",
  "discoveryEndpoint": "https://accounts.google.com/.well-known/openid-configuration",
  "loginEnabled": false,
  "prompt": "select_account",
  "authenticationContextClassReference": [
    "mfa",
    "pwd"
  ],
  "additionalScopes": "groups roles",
  "emailVerifiedRequired": false,
  "rpInitiatedLogoutEnabled": false
}