Remote identity providers

Remote identity providers are upstream OAuth or OIDC issuers used to authenticate MCP clients before they reach servers. Open the Remote Identity Providers page from Organization settings > Identity > Remote Identity Providers in the dashboard.

Access requirements

Viewing this page requires the org:read scope, which both default roles hold, so Members and Admins can browse providers. Creating, moving, and deleting providers requires org:admin, which only the Admin role includes by default.

Organizational and project-specific providers

The page splits providers into two sections. Organizational Remote Identity Providers are shared across every project and inherited everywhere. Project-Specific Remote Identity Providers are scoped to one project.

Each table shows a Provider column (the display name plus the issuer URL) and a Clients column with a count such as “N clients”. The project-specific table also shows a Project column.

Creating and moving providers

The New Remote Identity Provider button opens a create sheet. Row actions change a provider’s scope after creation. Make organizational promotes a project-specific provider so every project inherits it. Make project-specific and Move to another project open a scope picker dialog to place the provider in a single project.

Delete runs a preflight check before removing a provider. If clients are still registered, the dialog reports “Clients must be deleted first” and shows the registered client count and the affected MCP server names.

Inspecting issuers and clients

Selecting a provider opens its detail view with Overview, Clients, and Settings tabs. Selecting a registered client opens a client detail view with Overview, MCP Servers, Sessions, and Settings tabs.

MCP servers attach an issuer from their Authentication settings. See MCP servers for how servers reference a provider.