---
title: "OidcSettings"
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.ezghcloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

Path: EZGH SSO API

## Fields

- `OidcSettings.accessTokenAudience` (string | null, required) — The access token's aud; null is the client ID.
  - maxLength 256
- `OidcSettings.accessTokenLifetimeSeconds` (integer, required) — The RFC 9068 JWT access token's lifetime. Default 900.
  - min 300; max 3600
- `OidcSettings.applicationType` (string, required) — web is confidential; spa and native are public clients that must use PKCE (S256). Can't change.
  - one of `"web"`, `"spa"`, `"native"`
- `OidcSettings.backchannelLogoutUri` (string | null, required) — A public https URL that receives OpenID Connect back-channel logout tokens, through hardened egress.
  - format `uri`
- `OidcSettings.clientId` (string, required)
- `OidcSettings.clientSecrets` (array<object>, required) — Live client secrets' metadata, oldest first. Never a secret.
  - `OidcSettings.clientSecrets.createdAt` (string, required)
    - format `date-time`
  - `OidcSettings.clientSecrets.createdBy` (object, required)
    - `OidcSettings.clientSecrets.createdBy.id` (string, required)
    - `OidcSettings.clientSecrets.createdBy.type` (string, required)
  - `OidcSettings.clientSecrets.id` (string, required)
    - format `uuid`
  - `OidcSettings.clientSecrets.lastUsedAt` (string | null, required)
    - format `date-time`
  - `OidcSettings.clientSecrets.prefix` (string, required) — The first 13 characters (ezgh_scs_ and four more).
- `OidcSettings.groupsClaim` (string, required) — With the groups scope: the user's groups that are assigned to this application (the default), or all of them.
  - one of `"assigned"`, `"all"`
- `OidcSettings.idTokenSignedResponseAlg` (string, required) — Signs the ID token and the access token. Default RS256.
  - one of `"RS256"`, `"ES256"`
- `OidcSettings.initiateLoginUri` (string | null, required) — https; the portal tile opens it with ?iss=<issuer> (OpenID Connect third-party-initiated login).
  - format `uri`
- `OidcSettings.issuer` (string, required)
  - format `uri`
- `OidcSettings.jwks` (object | null, required) — The client's public keys by value, a JWK set ({ keys: [...] }), for private_key_jwt. 1–10 RSA (2048+ bits) or EC (P-256/384/521) signing keys, a kid on each when there are several.
- `OidcSettings.jwksFetchError` (string | null, required)
- `OidcSettings.jwksFetchedAt` (string | null, required)
  - format `date-time`
- `OidcSettings.jwksUri` (string | null, required) — A public https URL of the client's JWK set, for private_key_jwt; fetched through hardened egress and stored.
  - format `uri`
- `OidcSettings.postLogoutRedirectUris` (array<string>, required)
  - format `uri`
- `OidcSettings.redirectUris` (array<string>, required) — Exact URIs. https, or http on loopback; a native application may use a reverse-domain private scheme, and its loopback IP redirects match any port (RFC 8252).
  - format `uri`
- `OidcSettings.tokenEndpointAuthMethod` (string, required) — web: client_secret_basic (the default), client_secret_post or private_key_jwt; spa and native: none.
  - one of `"client_secret_basic"`, `"client_secret_post"`, `"private_key_jwt"`, `"none"`


Source: https://docs.ezghcloud.com/sso-api/schemas/OidcSettings/index.md