Set IdP initiated auth config

Add MCP server to your AI tool

Allow AI tools and LLMs to interact with the API documentation portal through MCP.

MCP server URL


        
          
            https://openapi.logto.io/mcp

Standard setup for AI tools providing an mcp.json file

{
  "Logto API references MCP server": {
    "url": "https://openapi.logto.io/mcp"
  }
}

PUT /api/sso-connectors/{id}/idp-initiated-auth-config

O auth2

Set IdP initiated authentication config for a given SAML SSO connector. Any existing IdP initiated auth config will be overwritten.

Path parameters

id string Required

The unique identifier of the sso connector.

application/json

Body

object Required

defaultApplicationId Required

The unique identifier for the application that users will sign in to using IdP initiated authentication. The application type must be Traditional or SPA. autoSendAuthorizationRequest is not supported for SPA applications.

Minimum length is 1, maximum length is 21.
autoSendAuthorizationRequest Required

Whether to automatically send an authorization request to the application's OIDC authorization endpoint when a IdP initiated authentication request is received. If not provided, Logto will use the default value false.
clientIdpInitiatedAuthCallbackUri Required

The callback URI for the IdP initiated authentication request. Only available when autoSendAuthorizationRequest is false. Logto will redirect the user to this URI after the IdP initiated authentication request is received. You should manually trigger the authorization request to the application's OIDC authorization endpoint at the client side.
redirectUri

The sign-in callback redirect URI for the application. This URI must be registered in the application's OIDC client metadata. If not provided, Logto will use the first registered redirect URI of the application. Only available when autoSendAuthorizationRequest is true.
authParameters

The additional parameters to be sent to the application's OIDC authorization endpoint, e.g. resources and scopes. Only available when autoSendAuthorizationRequest is true.

defaultApplicationId Required

The unique identifier for the application that users will sign in to using IdP initiated authentication. The application type must be Traditional or SPA. autoSendAuthorizationRequest is not supported for SPA applications.

Minimum length is 1, maximum length is 21.
autoSendAuthorizationRequest Required

Whether to automatically send an authorization request to the application's OIDC authorization endpoint when a IdP initiated authentication request is received. If not provided, Logto will use the default value false.
clientIdpInitiatedAuthCallbackUri

The callback URI for the IdP initiated authentication request. Only available when autoSendAuthorizationRequest is false. Logto will redirect the user to this URI after the IdP initiated authentication request is received. You should manually trigger the authorization request to the application's OIDC authorization endpoint at the client side.
redirectUri

The sign-in callback redirect URI for the application. This URI must be registered in the application's OIDC client metadata. If not provided, Logto will use the first registered redirect URI of the application. Only available when autoSendAuthorizationRequest is true.
authParameters object

The additional parameters to be sent to the application's OIDC authorization endpoint, e.g. resources and scopes. Only available when autoSendAuthorizationRequest is true.
Hide authParameters attribute Show authParameters attribute object
- scope string

Responses

200 application/json

The updated IdP initiated auth config.
Hide response attributes Show response attributes object
- tenantId string Required
  
  Maximum length is 21.
- connectorId string Required
  
  Minimum length is 1, maximum length is 128.
- defaultApplicationId string Required
  
  Minimum length is 1, maximum length is 21.
- redirectUri string | null Required
- authParameters object Required
  
  Hide authParameters attribute Show authParameters attribute object
  
  scope string
- autoSendAuthorizationRequest boolean Required
- clientIdpInitiatedAuthCallbackUri string | null Required
- createdAt number Required
400

The request body is invalid. The SSO connector is not a SAML connector or the application is not a Traditional web application.
401

Unauthorized
403

IdP initiated SSO is not included in the current plan. On a self-hosted deployment, the installed license does not grant it.
404

SSO connector or application not found.

PUT /api/sso-connectors/{id}/idp-initiated-auth-config

curl \
 --request PUT 'https://[tenant_id].logto.app/api/sso-connectors/{id}/idp-initiated-auth-config' \
 --header "Authorization: Bearer $ACCESS_TOKEN" \
 --header "Content-Type: application/json"

Request examples

{}

{
  "authParameters": {
    "scope": "string"
  }
}

Response examples (200)

{
  "tenantId": "string",
  "connectorId": "string",
  "defaultApplicationId": "string",
  "redirectUri": "string",
  "authParameters": {
    "scope": "string"
  },
  "autoSendAuthorizationRequest": true,
  "clientIdpInitiatedAuthCallbackUri": "string",
  "createdAt": 42.0
}