Identity providers

Sign-in works with any OpenID Connect provider: Okta, Microsoft Entra ID, Google Workspace, Keycloak, Authentik, Zitadel, Auth0, Ping and AWS Cognito.

Everywhere, create a web application with the authorization code flow and register:

• the redirect URL <portal URL>/_rapidoc/auth/callback,
• with logout: idp, the portal URL as a post-logout redirect.

A public client (PKCE only) needs no client secret. For a confidential client, set RAPIDOC_AUTH_CLIENT_SECRET when you run rapidoc serve.

Access rules by group need the groups in the ID token. Providers send them differently:

Provider	Setting
Okta	Add the groups scope: scopes: [openid, profile, email, groups], and a groups claim on the authorization server.
Microsoft Entra ID	Prefer app roles: claims: { groups: roles }. The groups claim holds IDs, not names, and is dropped for users in many groups.
Keycloak	Realm roles: claims: { groups: realm_access.roles }.
Auth0	Add the roles in an Action under a namespaced claim, e.g. claims: { groups: https://acme/roles }.

When rules use groups but a sign-in carries none, rapidoc serve logs a hint.

Put an OpenID Connect broker in front: Keycloak, Authentik, Zitadel or Ory Polis.

RAPIDOC_AUTH_ISSUER, RAPIDOC_AUTH_CLIENT_ID and RAPIDOC_AUTH_AUDIENCE override the config, so the same build can run against a staging and a production tenant.