Configure an external-login provider (Admin)

This guide covers the admin API for registering and managing external-login providers. Hub members use these providers to authenticate — see Log in with an external provider for the member-facing flow. Requires: a real user (JWT) session with team_owner role. API keys cannot manage provider configs.

The callback URL

Every provider config exposes a callback_url in its read response. This is the URL you must register in the external provider’s developer console as an allowed redirect URI. The callback URL has this form:

https://api.member.dev/api/v1/external-login/callback

Register this exact URL in the provider console (Google Cloud Console, Facebook App Dashboard, your company IdP, etc.) before testing the login flow.

Register a Google provider

Google is the only provider that can auto-create member accounts on first login without additional configuration (verified email required). A generic_oidc provider can also auto-create accounts for new members whose email belongs to a company domain the hub has verified — see the Verified-Domain SSO guide. Facebook and generic_oauth2 never auto-create accounts regardless of domain configuration. Prerequisites:

A Google Cloud project with the OAuth consent screen configured.
OAuth 2.0 credentials (client ID + secret) for a “Web application”.
The callback_url from Step 1 registered as an “Authorised redirect URI” in Google Console.

curl -X POST "https://api.member.dev/api/v1/teams/$TEAM_ID/external-login-providers" \
  -H "Authorization: Bearer $PLATFORM_TOKEN" \
  -H "Content-Type: application/vnd.api+json" \
  -d '{
    "data": {
      "type": "external_login_providers",
      "attributes": {
        "provider_kind": "google",
        "display_name": "Google",
        "client_id": "YOUR_GOOGLE_CLIENT_ID.apps.googleusercontent.com",
        "client_secret": "YOUR_GOOGLE_CLIENT_SECRET"
      }
    }
  }' | jq

Response (201):

{
  "data": {
    "type": "external_login_providers",
    "id": "cfg_abc123",
    "attributes": {
      "provider_kind": "google",
      "slug": "google",
      "display_name": "Google",
      "client_id": "YOUR_GOOGLE_CLIENT_ID.apps.googleusercontent.com",
      "client_secret_set": true,
      "enabled": true,
      "callback_url": "https://api.member.dev/api/v1/external-login/callback",
      "created_at": "2026-06-25T10:00:00Z",
      "updated_at": "2026-06-25T10:00:00Z"
    }
  }
}

client_secret is write-only — it is AES-256-GCM encrypted at rest and never returned. The client_secret_set: true flag confirms a secret is stored. Google’s authorization, token, and JWKS endpoints are hardcoded platform constants — you do not supply them.

Register a Facebook provider

Facebook members cannot auto-create accounts. They must connect their Facebook identity while already logged in, then use Facebook to log in on subsequent visits. Prerequisites:

A Facebook App (facebook.com/developers) with “Facebook Login” product added.
The callback_url added to “Valid OAuth Redirect URIs” in the Facebook App Dashboard.

curl -X POST "https://api.member.dev/api/v1/teams/$TEAM_ID/external-login-providers" \
  -H "Authorization: Bearer $PLATFORM_TOKEN" \
  -H "Content-Type: application/vnd.api+json" \
  -d '{
    "data": {
      "type": "external_login_providers",
      "attributes": {
        "provider_kind": "facebook",
        "display_name": "Facebook",
        "client_id": "YOUR_FACEBOOK_APP_ID",
        "client_secret": "YOUR_FACEBOOK_APP_SECRET"
      }
    }
  }' | jq

Facebook’s Graph API endpoints are hardcoded platform constants.

Register a generic OIDC provider

Use this for company SSO (Okta, Auth0, Azure AD, Keycloak, etc.) or any standards-compliant OIDC Identity Provider. By default, generic OIDC members cannot auto-create accounts — they must connect while logged in first. Exception: if the hub has a Verified Domain configured, new members whose email matches a verified domain can have accounts created automatically on first login (connect-first: the platform never merges into an existing account). Prerequisites:

The callback_url registered as a redirect URI in your IdP.
Your IdP’s discovery URL (typically https://your-idp.example.com/.well-known/openid-configuration).

Security constraints enforced at write time:

issuer must not be https://accounts.google.com or any other platform-trusted issuer. Generic configs claiming a trusted issuer are rejected (prevents token-forging attacks).
All URL fields (discovery_url, authorize_url, token_url, userinfo_url, jwks_uri) are SSRF-validated: HTTPS-only, no loopback, no private IPs, no cloud metadata endpoints.

curl -X POST "https://api.member.dev/api/v1/teams/$TEAM_ID/external-login-providers" \
  -H "Authorization: Bearer $PLATFORM_TOKEN" \
  -H "Content-Type: application/vnd.api+json" \
  -d '{
    "data": {
      "type": "external_login_providers",
      "attributes": {
        "provider_kind": "generic_oidc",
        "display_name": "Acme Corp SSO",
        "slug": "acme-sso",
        "client_id": "YOUR_CLIENT_ID",
        "client_secret": "YOUR_CLIENT_SECRET",
        "issuer": "https://auth.acme.example.com",
        "discovery_url": "https://auth.acme.example.com/.well-known/openid-configuration",
        "scopes": ["openid", "email", "profile"]
      }
    }
  }' | jq

You can supply individual endpoint URLs (authorize_url, token_url, jwks_uri) instead of discovery_url if your IdP does not expose a discovery document. If discovery_url is supplied, it takes precedence and the individual fields are populated from it at runtime — supply only the ones your IdP does not include in its discovery document.

Register a generic OAuth2 provider

Use for providers that do not support OIDC (no id_token) but expose a userinfo-style endpoint.

curl -X POST "https://api.member.dev/api/v1/teams/$TEAM_ID/external-login-providers" \
  -H "Authorization: Bearer $PLATFORM_TOKEN" \
  -H "Content-Type: application/vnd.api+json" \
  -d '{
    "data": {
      "type": "external_login_providers",
      "attributes": {
        "provider_kind": "generic_oauth2",
        "display_name": "My OAuth2 Provider",
        "client_id": "YOUR_CLIENT_ID",
        "client_secret": "YOUR_CLIENT_SECRET",
        "authorize_url": "https://provider.example.com/oauth/authorize",
        "token_url": "https://provider.example.com/oauth/token",
        "userinfo_url": "https://provider.example.com/oauth/userinfo",
        "scopes": ["email", "profile"],
        "claim_map": {
          "sub": "id",
          "email": "email_address",
          "name": "full_name"
        }
      }
    }
  }' | jq

claim_map is optional. Use it when the provider’s userinfo response uses non-standard claim names. Keys are the standard member.dev field names (sub, email, email_verified, name); values are the corresponding claim names in the provider’s userinfo response. The sub field is required.

Provider config attributes reference

Attribute	Type	Writable	Notes
`provider_kind`	string	Create	`google`, `facebook`, `generic_oidc`, `generic_oauth2`
`slug`	string	Yes	URL-path identifier. Defaults to `provider_kind`. Must be unique per hub.
`display_name`	string	Yes	Button label shown to members.
`client_id`	string	Yes	Your app ID / client ID from the provider console.
`client_secret`	string	Yes (write-only)	Your app secret. AES-256-GCM encrypted at rest. Never returned on read.
`client_secret_set`	boolean	Read-only	`true` if a secret is stored.
`enabled`	boolean	Yes	Set to `false` to disable the provider without deleting the config.
`callback_url`	string	Read-only	Register this in the provider console.
`issuer`	string	Yes (generic only)	OIDC issuer URI. Must match the `iss` claim in tokens.
`discovery_url`	string	Yes (generic only)	OIDC discovery document URL. SSRF-validated.
`authorize_url`	string	Yes (generic only)	Authorization endpoint. SSRF-validated.
`token_url`	string	Yes (generic only)	Token endpoint. SSRF-validated.
`userinfo_url`	string	Yes (generic only)	Userinfo / profile endpoint. SSRF-validated.
`jwks_uri`	string	Yes (generic_oidc only)	JWKS endpoint for id_token verification. SSRF-validated.
`scopes`	array of strings	Yes (generic only)	OAuth2 scopes to request.
`claim_map`	object	Yes (generic only)	Maps standard field names → provider claim names. Key = member.dev standard name (`sub`, `email`, `email_verified`, `name`); value = provider’s claim name in the userinfo response.

issuer, discovery_url, authorize_url, token_url, userinfo_url, jwks_uri, scopes, and claim_map are ignored for pre-canned providers (google, facebook) — their endpoints are hardcoded platform constants.

List providers

curl "https://api.member.dev/api/v1/teams/$TEAM_ID/external-login-providers" \
  -H "Authorization: Bearer $PLATFORM_TOKEN" | jq '.data[] | {id: .id, kind: .attributes.provider_kind, enabled: .attributes.enabled}'

Returns all providers including disabled ones.

Retrieve a provider

curl "https://api.member.dev/api/v1/teams/$TEAM_ID/external-login-providers/$PROVIDER_ID" \
  -H "Authorization: Bearer $PLATFORM_TOKEN" | jq

Update a provider (PATCH)

PATCH is partial — only supply the fields you want to change.

# Disable a provider
curl -X PATCH "https://api.member.dev/api/v1/teams/$TEAM_ID/external-login-providers/$PROVIDER_ID" \
  -H "Authorization: Bearer $PLATFORM_TOKEN" \
  -H "Content-Type: application/vnd.api+json" \
  -d '{
    "data": {
      "type": "external_login_providers",
      "id": "'"$PROVIDER_ID"'",
      "attributes": {
        "enabled": false
      }
    }
  }'

# Rotate the client secret
curl -X PATCH "https://api.member.dev/api/v1/teams/$TEAM_ID/external-login-providers/$PROVIDER_ID" \
  -H "Authorization: Bearer $PLATFORM_TOKEN" \
  -H "Content-Type: application/vnd.api+json" \
  -d '{
    "data": {
      "type": "external_login_providers",
      "id": "'"$PROVIDER_ID"'",
      "attributes": {
        "client_secret": "NEW_SECRET"
      }
    }
  }'

Delete a provider

Soft-deletes the config. Existing member logins linked to this provider will fail (no existing link to resolve against). Returns 204 No Content.

curl -X DELETE "https://api.member.dev/api/v1/teams/$TEAM_ID/external-login-providers/$PROVIDER_ID" \
  -H "Authorization: Bearer $PLATFORM_TOKEN"

Common errors

HTTP	Code	Meaning
`422`	`ssrf_rejected`	A generic provider URL failed SSRF validation (must be HTTPS, no private IPs).
`422`	`trusted_issuer_reserved`	`issuer` for a generic config matches a platform-trusted issuer (e.g. `https://accounts.google.com`).
`422`	`no_active_hub`	The team has no active hub. Create a hub first.
`404`	`external_login_provider_not_found`	The provider ID does not exist or belongs to a different team.

Start here

Core concepts

Guides

API reference

Configure an external-login provider (Admin)

The callback URL

Register a Google provider

Register a Facebook provider

Register a generic OIDC provider

Register a generic OAuth2 provider

Provider config attributes reference

List providers

Retrieve a provider

Update a provider (PATCH)

Delete a provider

Common errors

​The callback URL

​Register a Google provider

​Register a Facebook provider

​Register a generic OIDC provider

​Register a generic OAuth2 provider

​Provider config attributes reference

​List providers

​Retrieve a provider

​Update a provider (PATCH)

​Delete a provider

​Common errors

The callback URL

Register a Google provider

Register a Facebook provider

Register a generic OIDC provider

Register a generic OAuth2 provider

Provider config attributes reference

List providers

Retrieve a provider

Update a provider (PATCH)

Delete a provider

Common errors