> ## Documentation Index
> Fetch the complete documentation index at: https://docs.k16solutions.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure OIDC

> Add an OpenID Connect provider with issuer discovery or manual endpoints.

Create an OIDC application in your identity provider before you finish the K16 form.

## Register the callback

Select **OIDC** in **New identity provider**. Copy the **OIDC redirect URL** from **Service provider values** and add it to the application's allowed callback or redirect URLs.

## Create the provider

<Steps>
  <Step title="Choose OIDC">
    Open **Settings** > **Single sign-on** > **New identity provider**, then select **OIDC**.
  </Step>

  <Step title="Name the provider">
    Enter **Provider name**. You cannot rename it later.
  </Step>

  <Step title="Enter client registration">
    Enter **Client ID** and **Client secret** from the approved identity-provider application.
  </Step>

  <Step title="Configure the issuer">
    Enter **Issuer URL**. Leave **Discover endpoints from issuer** on when the provider publishes standard discovery metadata.
  </Step>

  <Step title="Map claims">
    Enter **Email claim** and **Username claim** as issued in the ID token.
  </Step>

  <Step title="Create and test">
    Review **Enabled for sign-in**, select **Create**, assign a pilot user, and test the normal K16 sign-in flow.
  </Step>
</Steps>

## Configure endpoints manually

Turn off **Discover endpoints from issuer** only when your provider cannot publish usable discovery metadata. You must then enter:

* **Authorize URL**
* **Token URL**
* **Attributes URL**
* **JWKS URI**

Use the values from the identity provider's official application configuration. Do not guess endpoints from a sign-in page URL.

## Rotate the client secret

After save, K16 does not display the full client secret. When you edit the provider, leave the protected placeholder unchanged unless you intend to rotate the secret.

1. Create the replacement secret in the identity provider.
2. Enter it in **Client secret**.
3. Select **Save changes**.
4. Test a pilot sign-in.
5. Retire the previous secret according to your identity-provider policy.

<Warning>Never include a client secret in screenshots, documentation, tickets, or chat.</Warning>

See [Troubleshoot SSO](/administration/sso/troubleshoot).