AI Control Plane · Remote identity providers
Remote identity providers
Register upstream OAuth and OIDC issuers that authenticate MCP clients, and manage whether each issuer is shared across the organization or scoped to a single project.
Remote identity providers are upstream OAuth or OIDC issuers used to authenticate MCP clients before they reach servers. Open the Remote Identity Providers page from Organization settings > Identity > Remote Identity Providers in the dashboard.
Access requirements
Section titled “Access requirements”Viewing this page requires the org:read scope, which both default roles hold, so Members and Admins can browse providers. Creating, moving, and deleting providers requires org:admin, which only the Admin role includes by default.
Organizational and project-specific providers
Section titled “Organizational and project-specific providers”The page splits providers into two sections. Organizational Remote Identity Providers are shared across every project and inherited everywhere. Project-Specific Remote Identity Providers are scoped to one project.
Each table shows a Provider column (the display name plus the issuer URL) and a Clients column with a count such as “N clients”. The project-specific table also shows a Project column.
Creating and moving providers
Section titled “Creating and moving providers”The New Remote Identity Provider button opens a create sheet. Row actions change a provider’s scope after creation. Make organizational promotes a project-specific provider so every project inherits it. Make project-specific and Move to another project open a scope picker dialog to place the provider in a single project.
Delete runs a preflight check before removing a provider. If clients are still registered, the dialog reports “Clients must be deleted first” and shows the registered client count and the affected MCP server names.
Inspecting issuers and clients
Section titled “Inspecting issuers and clients”Selecting a provider opens its detail view with Overview, Clients, and Settings tabs. Selecting a registered client opens a client detail view with Overview, MCP Servers, Sessions, and Settings tabs.
MCP servers attach an issuer from their Authentication settings. See Upstream credentials for how a server references a provider and what an end user sees when connecting one.