> ## Documentation Index
> Fetch the complete documentation index at: https://docs.discord.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configuring Identity Providers

> Configure OIDC, Steam, EOS, and other identity providers for provisional accounts, including the full OIDC integration requirements.

export const BrowserIcon = props => <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none"><path fill="currentColor" fill-rule="evenodd" d="M1 6a3 3 0 0 1 3-3h16a3 3 0 0 1 3 3v2a1 1 0 0 1-1 1H2a1 1 0 0 1-1-1V6Zm3 1a1 1 0 1 0 0-2 1 1 0 0 0 0 2Zm4-1a1 1 0 1 1-2 0 1 1 0 0 1 2 0Zm2 1a1 1 0 1 0 0-2 1 1 0 0 0 0 2Z" clip-rule="evenodd" /><path fill="currentColor" d="M1 12a1 1 0 0 1 1-1h20a1 1 0 0 1 1 1v6a3 3 0 0 1-3 3H4a3 3 0 0 1-3-3v-6Z" /></svg>;

export const GlobeEarthIcon = props => <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" fill="none"><path fill="currentColor" fill-rule="evenodd" d="M23 12a11 11 0 1 1-22 0 11 11 0 0 1 22 0Zm-4.16 5.85A9 9 0 0 0 15 3.52V4a3 3 0 0 1-3 3h-.77c-.13 0-.23.1-.23.23A2.77 2.77 0 0 1 8.23 10c-.13 0-.23.1-.23.23v1.52c0 .14.11.25.25.25H13a3 3 0 0 1 3 3v.77c0 .13.1.23.23.23 1.2 0 2.23.77 2.61 1.85ZM3.18 10.18A9 9 0 0 0 11 20.94v-2.7c0-.14-.1-.24-.23-.24h-.65A2.12 2.12 0 0 1 8 15.88c0-.56-.22-1.1-.62-1.5l-4.2-4.2Z" clip-rule="evenodd" /></svg>;

Unless you are using the [Bot Token Endpoint](/developers/discord-social-sdk/development-guides/provisional-accounts/bot-token-endpoint), you must configure an identity provider before you can create provisional accounts. This applies to both [Server Authentication with External Credentials Exchange](/developers/discord-social-sdk/development-guides/provisional-accounts/external-credentials-exchange) and [Public Client Integration](/developers/discord-social-sdk/development-guides/provisional-accounts/public-client).

Not sure which authentication method to use? See [Choosing an Authentication Method](/developers/discord-social-sdk/development-guides/provisional-accounts/overview#choosing-an-authentication-method).

## Configuring Your Identity Provider

<Warning>
  If you are using the [Bot Token Endpoint](/developers/discord-social-sdk/development-guides/provisional-accounts/bot-token-endpoint), no Identity Provider configuration is required.
</Warning>

Open the Discord app for your game in the [Developer Portal](https://discord.com/developers/applications). Find the [External Auth](https://discord.com/developers/applications/select/social-sdk/external-auth-providers) page under the `Discord Social SDK` section in the sidebar.

Click on `Add Auth Provider` and choose the type of provider you're using (Steam, OIDC, etc.). Fill in the required details for your provider.

We currently support the following provider types:

* OpenID Connect (OIDC)
* Steam Session Tickets
* Epic Online Services (EOS)
* Unity
* Apple
* PlayStation Network (PSN)

If you are configuring OIDC, see [OIDC Integration Requirements](#oidc-integration-requirements) for the full list of requirements your issuer URL, discovery document, and ID tokens must meet.

Providers are represented in Discord's systems by the following types:

### External Auth Types

| Type                                  | Description                                                                   |
| ------------------------------------- | ----------------------------------------------------------------------------- |
| OIDC                                  | OpenID Connect ID token                                                       |
| STEAM\_SESSION\_TICKET                | A Steam auth ticket for web generated with discord as the identity            |
| EPIC\_ONLINE\_SERVICES\_ACCESS\_TOKEN | Access token for Epic Online Services. Supports EOS Auth access tokens        |
| EPIC\_ONLINE\_SERVICES\_ID\_TOKEN     | ID token for Epic Online Services. Supports both EOS Auth + Connect ID tokens |
| UNITY\_SERVICES\_ID\_TOKEN            | Unity Services authentication ID token                                        |
| APPLE\_ID\_TOKEN                      | Apple sign-in authentication ID token                                         |
| PLAYSTATION\_NETWORK\_ID\_TOKEN       | PlayStation Network account authentication ID token                           |
| DISCORD\_BOT\_ISSUED\_ACCESS\_TOKEN   | An access token for a user authenticated via the Bot Token Endpoint           |

***

## OIDC Integration Requirements

If you are using OpenID Connect (OIDC) as your identity provider, Discord validates your configuration and tokens against the requirements below. Meeting these requirements is necessary both when saving your OIDC configuration in the [Developer Portal](https://discord.com/developers/applications/select/social-sdk/external-auth-providers) and at runtime when tokens are exchanged.

### Issuer URL Requirements

The issuer URL you configure in the Developer Portal must meet all of the following:

| Requirement                 | Details                                                                                                                 |
| --------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| HTTPS scheme                | Must use `https://` — HTTP is not permitted                                                                             |
| No query parameters         | The URL must not contain a `?` character                                                                                |
| No fragment                 | The URL must not contain a `#` character                                                                                |
| No embedded credentials     | The URL must not contain a username or password                                                                         |
| Public hostname             | The hostname must have at least two segments (e.g. `example.com`). Bare hostnames such as `localhost` are not permitted |
| No private or reserved TLDs | The hostname must not end in `.local`, `.arpa`, `.internal`, or `.localhost`                                            |
| No IP addresses             | The hostname must not be a bare IP address (e.g. `192.168.1.1`)                                                         |

Non-standard ports (e.g. `:8080`) are permitted.

### OIDC Discovery Document Requirements

Discord fetches your OIDC configuration from `{issuer_url}/.well-known/openid-configuration` per [RFC 8414](https://www.rfc-editor.org/rfc/rfc8414). This endpoint must:

* Be accessible over HTTPS
* **Not require HTTP redirects** — Discord does not follow redirects when fetching this document or your JWKS endpoint
* Return a valid JSON object (not an array)

The discovery document must include these fields:

| Field                                   | Type             | Requirement                                                                    |
| --------------------------------------- | ---------------- | ------------------------------------------------------------------------------ |
| `issuer`                                | HTTPS URL        | Must exactly match the issuer URL used to fetch the document                   |
| `jwks_uri`                              | HTTPS URL        | URI to your JWKS signing key endpoint                                          |
| `id_token_signing_alg_values_supported` | Array of strings | Must contain at least one [supported algorithm](#supported-signing-algorithms) |

`authorization_endpoint` and `token_endpoint` are accepted but not used by Discord.

### Supported Signing Algorithms

Your ID tokens must be signed using an asymmetric algorithm. Discord supports:

| Algorithm family | Algorithms                |
| ---------------- | ------------------------- |
| RSA              | `RS256`, `RS384`, `RS512` |
| ECDSA            | `ES256`, `ES384`, `ES512` |
| RSA-PSS          | `PS256`, `PS384`, `PS512` |

Symmetric (HMAC) algorithms such as `HS256` are not supported. Any unsupported algorithms listed in `id_token_signing_alg_values_supported` are silently ignored.

### ID Token Requirements

The OIDC ID token passed as `external_auth_token` must meet all of the following:

| Requirement       | Details                                                                                                                                                                     |
| ----------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `kid` header      | The JWT header must include a `kid` (Key ID) field that matches a key in your JWKS                                                                                          |
| Signing algorithm | Must use one of the [supported algorithms](#supported-signing-algorithms) listed in your discovery document                                                                 |
| `iss` claim       | Must exactly match the configured issuer URL                                                                                                                                |
| `sub` claim       | Required — the unique user identifier from your identity provider                                                                                                           |
| `aud` claim       | Must include the client ID configured for this application in the [Developer Portal](https://discord.com/developers/applications/select/social-sdk/external-auth-providers) |
| `exp` claim       | Required — token must not be expired                                                                                                                                        |
| `iat` claim       | Required — token must have been issued within the past **7 days**                                                                                                           |

The optional `preferred_username` claim (1–32 characters) sets the provisional account's display name if present. See [Setting Display Names](/developers/discord-social-sdk/development-guides/provisional-accounts/managing-accounts#setting-display-names) for how display names are chosen across providers.

***

## Next Steps

Once your identity provider is configured, continue to the authentication method that matches your setup:

<CardGroup cols={2}>
  <Card title="External Credentials Exchange" href="/developers/discord-social-sdk/development-guides/provisional-accounts/external-credentials-exchange" icon={<GlobeEarthIcon />}>
    Exchange an external provider token (OIDC, Steam, EOS, etc.) server-side.
  </Card>

  <Card title="Public Client Integration" href="/developers/discord-social-sdk/development-guides/provisional-accounts/public-client" icon={<BrowserIcon />}>
    Authenticate directly from the client when you don't have a backend.
  </Card>
</CardGroup>

Need help? Join the [Discord Developers Server](https://discord.gg/discord-developers) and share questions in the `#social-sdk-dev-help` channel for support from the community.

If you encounter a bug while working with the Social SDK, please report it here:  [https://dis.gd/social-sdk-bug-report](https://dis.gd/social-sdk-bug-report)

***

## Change Log

| Date           | Changes                                                   |
| -------------- | --------------------------------------------------------- |
| July 14, 2026  | Split the provisional accounts guide into its own section |
| March 17, 2025 | Initial release                                           |