# Remote identity providers

Remote identity providers are upstream OAuth or OIDC issuers used to authenticate MCP clients before they reach servers. Open the **Remote Identity Providers** page from **Organization settings > Identity > Remote Identity Providers** in the dashboard.

## Access requirements

<Callout type="info">
  Viewing this page requires the `org:read` scope, which both default roles hold, so Members and Admins can browse providers. Creating, moving, and deleting providers requires `org:admin`, which only the [Admin role](/docs/ai-control-plane/org-admin/roles-and-permissions) includes by default.
</Callout>

## Organizational and project-specific providers

The page splits providers into two sections. **Organizational Remote Identity Providers** are shared across every project and inherited everywhere. **Project-Specific Remote Identity Providers** are scoped to one project.

Each table shows a **Provider** column (the display name plus the issuer URL) and a **Clients** column with a count such as "N clients". The project-specific table also shows a **Project** column.

## Creating and moving providers

The **New Remote Identity Provider** button opens a create sheet. Row actions change a provider's scope after creation. **Make organizational** promotes a project-specific provider so every project inherits it. **Make project-specific** and **Move to another project** open a scope picker dialog to place the provider in a single project.

**Delete** runs a preflight check before removing a provider. If clients are still registered, the dialog reports "Clients must be deleted first" and shows the registered client count and the affected MCP server names.

## Inspecting issuers and clients

Selecting a provider opens its detail view with **Overview**, **Clients**, and **Settings** tabs. Selecting a registered client opens a client detail view with **Overview**, **MCP Servers**, **Sessions**, and **Settings** tabs.

MCP servers attach an issuer from their Authentication settings. See [MCP servers](/docs/ai-control-plane/distribute/mcp-servers) for how servers reference a provider.