--- title: "ezgh sso applications create" description: "Create an application: an OpenID Connect client, a SAML service provider, or an EZGH app." --- > Documentation Index > Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt > Use this file to discover all available pages before exploring further. # ezgh sso applications create {/* Generated by ezgh-cli's internal/tools/clidocs from the ezgh command tree. Don't edit: change the command's help in ezgh-cli and regenerate. */} ```sh ezgh sso applications create --name [--kind oidc|saml|ezgh] [settings] | --catalog [--param name=value]… [flags] ``` Create an application that directory users sign in to. Assign users or groups to it with `ezgh sso assignments add`: nobody can sign in until they're assigned. An oidc application is an OpenID Connect client of the directory's issuer. `--type` is web (a server that keeps a client secret, or signs a private_key_jwt assertion), spa or native (public clients: no secret, PKCE required); it can't change later. Give its exact `--redirect-uri` (https; http only on a loopback address; native applications may use a reverse-domain scheme, and a loopback IP redirect matches any port). Its client ID is the application's ID. A web application that authenticates with a client secret gets its first one now: it's printed with the application, once. A saml application (`--kind` saml; implied by `--catalog` or a saml setting) is a SAML 2.0 service provider of the directory's identity provider. Give its `--entity-id` and `--acs-url`, or import them (with its single logout URL and certificates) from its `--metadata-url` or `--metadata-file`, once; or start from the catalog: `--catalog` <id> fills the vendor's settings, with `--param` for the values they need, such as your Slack domain. Flags given with metadata or `--catalog` win. Then register the IdP at the service provider: `ezgh sso applications idp ` shows its metadata URL, entity ID and SSO URL, and `idp-certificate` prints its certificate. An ezgh application (`--kind` ezgh, or just `--product`) puts an EZGH product, such as MCP Central (`--product` mcpcentral), on the portal and sets how long its MCP clients' resource tokens last. IAM, not assignments, decides what directory users may do in the product. MCP Central adds and manages its own application when its project is associated with the directory (`ezgh mcp-central sso associate`); that one can't be changed here. Applications count against the sso.applications.count quota. Part of [`ezgh sso applications`](/cli/reference/sso-applications). ## Examples ```sh ezgh sso applications create --name Wiki --redirect-uri https://wiki.acme.com/oauth/callback ezgh sso applications create --name Dashboard --type spa --redirect-uri https://dash.acme.com/cb ezgh sso applications create --name CLI --type native --redirect-uri http://127.0.0.1/callback ezgh sso applications create --name Billing --auth-method private_key_jwt --jwks-uri https://billing.acme.com/jwks.json --redirect-uri https://billing.acme.com/cb ezgh sso applications create --name "MCP Central" --product mcpcentral ezgh sso applications create --catalog slack --param slackDomain=acme.slack.com ezgh sso applications create --name Grafana --kind saml --metadata-url https://grafana.acme.com/saml/metadata ezgh sso applications create --name Tool --entity-id https://tool.acme.com --acs-url https://tool.acme.com/saml/acs \ --attribute 'email=${user.email}' --attribute 'groups=${user.groups}' ``` ## Flags | Flag | Type | Default | Description | | --- | --- | --- | --- | | `--access-token-audience` | string | | for oidc: the access tokens' aud (default: the client ID) | | `--access-token-lifetime` | duration | `15m0s` | for oidc: how long access tokens last, 5m to 1h | | `--acs-url` | strings, comma-separated or repeated | | for saml: an exact assertion consumer service URL, HTTP-POST (repeat, at most 10; the first is the default) | | `--attribute` | string, repeatable | | for saml: an attribute name=template, such as email=${user.email} (repeat; replaces the list; "" for none) | | `--attribute-name-format` | string | | for saml: the NameFormat of the `--attribute` values given: unspecified (the default), uri or basic | | `--auth-method` | string | | for oidc web applications: client_secret_basic (the default), client_secret_post or private_key_jwt | | `--backchannel-logout-uri` | string | | for oidc: where to send OpenID Connect back-channel logout tokens (https) | | `--catalog` | string | | for saml: start from this catalog application's settings (`ezgh sso catalog list`) | | `--default-relay-state` | string | | for saml: the RelayState of IdP-initiated sign-in, where the service provider lands ("" for none) | | `--description` | string | | a description | | `--encrypt-assertions` | boolean | | for saml: encrypt assertions to the service provider's encryption certificate | | `--encryption-algorithm` | string | | for saml: aes128-gcm (the default) or aes256-cbc | | `--encryption-certificate` | string, repeatable | | for saml: a PEM file with the service provider's encryption certificate (repeat; "" for none) | | `--entity-id` | string | | for saml: the service provider's entity ID (the assertion's audience) | | `--groups-claim` | string | | for oidc: which groups the groups claim lists, assigned (the default: groups assigned to the application) or all | | `--groups-filter` | string | | for saml: which groups ${user.groups} lists, assigned (the default) or all | | `--id-token-alg` | string | | for oidc: how ID and access tokens are signed, RS256 (the default) or ES256 | | `--idp-initiated` | boolean | `true` | for saml: allow IdP-initiated sign-in (the portal's tile) | | `--initiate-login-uri` | string | | for oidc: where the portal's tile sends people to start signing in (https) | | `--jwks` | string | | for private_key_jwt: the client's public keys as a JWK Set, @file or - for stdin | | `--jwks-uri` | string | | for private_key_jwt: the https URL of the client's public keys | | `--kind` | string | `oidc` | oidc (an OpenID Connect client), saml (a SAML service provider) or ezgh (an EZGH app, such as MCP Central) | | `--launch-url` | string | | for ezgh: where the portal's tile opens, under the product's URL | | `--logo` | string | | a PNG or JPEG file (at most 512 KiB and 1024×1024) for the application's portal tile | | `--metadata-file` | string | | for saml: import the service provider's metadata from this XML file | | `--metadata-url` | string | | for saml: import the service provider's metadata from this https URL (once; never refreshed) | | `--name` | string | | the application's name, shown on the portal | | `--name-id-format` | string | | for saml: email (the default), persistent (the user's ID) or transient | | `--param` | string, repeatable | | for `--catalog`: a parameter of the catalog application, name=value (repeat) | | `--post-logout-redirect-uri` | strings, comma-separated or repeated | | for oidc: an exact URI to return to after logout (repeat) | | `--product` | string | | for ezgh: the EZGH product (mcpcentral) | | `--redirect-uri` | strings, comma-separated or repeated | | for oidc: an exact redirect URI (repeat for several, at most 20) | | `--resource-token-lifetime` | duration | `1h0m0s` | for ezgh: how long MCP clients' resource tokens last, 5m to 1h | | `--sign-assertion` | boolean | `true` | for saml: sign the Assertion | | `--sign-response` | boolean | `true` | for saml: sign the Response | | `--signing-certificate` | string, repeatable | | for saml: a PEM file with the service provider's signing certificate (repeat; "" for none) | | `--slo-binding` | string | | for saml: HTTP-Redirect (the default) or HTTP-POST | | `--slo-url` | string | | for saml: the service provider's single logout URL ("" for none) | | `--type` | string | `web` | for oidc: web (a server that keeps a secret), spa or native (public clients, PKCE required); can't change later | This command also takes the [global flags](/cli/reference#global-flags). Source: https://docs.ezghcloud.com/cli/reference/sso-applications-create/index.mdx