Retrieve information about authentication provider

GET /groups/{groupId}/apps/{appId}/auth_providers/{providerId}

Token auth

Retrieve information about one of an application's authentication providers.

Path parameters

groupId string Required

An Atlas Project/Group ID.
appId string Required

The ObjectID of your application. The App Services API Project and Application IDs section demonstrates how to find this value.
providerId string Required

The unique _id value of an authentication provider

Responses

200 application/json

Successfully retrieved.
Any of:
AnonymousAuthProvider object EmailPasswordAuthProvider object ApiKeyAuthProvider object CustomJwtAuthProvider object CustomFunctionAuthProvider object AppleAuthProvider object GoogleAuthProvider object FacebookAuthProvider object
Hide attributes Show attributes

_id string

The authentication provider's unique ID.

name string Required

The name of the authentication provider. For Anonymous authentication, this value is always anon-user.

Value is anon-user.

type string Required

The name of the authentication provider. For Anonymous authentication, this value is always anon-user.

Value is anon-user.

disabled boolean

If true, the auth provider is disabled. Users cannot log in through the provider until it is enabled.
Hide attributes Show attributes

_id string

The authentication provider's unique ID.

name string Required

The name of the authentication provider. For Email/Password authentication, this value is always local-userpass.

Value is local-userpass.

type string Required

The name of the authentication provider. For Email/Password authentication, this value is always local-userpass.

Value is local-userpass.

disabled boolean

If true, the auth provider is disabled. Users cannot log in through the provider until it is enabled.

config object

One of:
PasswordRefreshBuiltIn object PasswordRefreshCustomFunction object PasswordRefreshBuiltIn object PasswordRefreshCustomFunction object PasswordRefreshBuiltIn object PasswordRefreshCustomFunction object

Hide attributes Show attributes

autoConfirm

If true, automatically confirm new user accounts without additional verification.

Value is true.

resetPasswordUrl string

The URL included in the email sent to users as part of the built-in password reset flow. The email also adds a unique password reset token and tokenId as query parameters.

This URL should handle user confirmation by passing the password reset token to a Realm SDK's resetPassword function.

resetPasswordSubject string

The subject line of the email sent to users as part of the built-in password reset flow.

Hide attributes Show attributes

autoConfirm

If true, automatically confirm new user accounts without additional verification.

Value is true.

runResetFunction boolean

If true, use a custom function that you define to handle the password reset process.

Value is true.

resetFunctionName string

The name of the custom function that handles the password reset process.

Hide attributes Show attributes

autoConfirm

If true, automatically confirm new user accounts without additional verification. For built-in email account confirmation, set this value to false.

Value is false.

emailConfirmationUrl string

The URL included in the email sent to new users as part of the built-in confirmation flow. The email also adds a unique confirmation token and tokenId as query parameters.

This URL should handle user confirmation by passing the confirmation token to a Realm SDK's confirmUser function or to the Admin API Confirm a Pending Email/Password User endpoint.

confirmEmailSubject string

The subject line of the email sent to new users as part of the built-in confirmation flow.

resetPasswordUrl string

The URL included in the email sent to users as part of the built-in password reset flow. The email also adds a unique password reset token and tokenId as query parameters.

This URL should handle user confirmation by passing the password reset token to a Realm SDK's resetPassword function.

resetPasswordSubject string

The subject line of the email sent to users as part of the built-in password reset flow.

Hide attributes Show attributes

autoConfirm

If true, automatically confirm new user accounts without additional verification. For built-in email account confirmation, set this value to false.

Value is false.

emailConfirmationUrl string

The URL included in the email sent to new users as part of the built-in confirmation flow. The email also adds a unique confirmation token and tokenId as query parameters.

This URL should handle user confirmation by passing the confirmation token to a Realm SDK's confirmUser function or to the Admin API Confirm a Pending Email/Password User endpoint.

confirmEmailSubject string

The subject line of the email sent to new users as part of the built-in confirmation flow.

runResetFunction boolean

If true, use a custom function that you define to handle the password reset process.

Value is true.

resetFunctionName string

The name of the custom function that handles the password reset process.

Hide attributes Show attributes

autoConfirm

If true, automatically confirm new user accounts without additional verification. For custom function account confirmation, set this value to false.

Value is false.

runConfirmationFunction boolean

If true, new email/password user account registrations use a custom function that you define to handle the confirmation process.

confirmationFunctionName string

The name of the custom function that handles the confirmation process.

resetPasswordUrl string

The URL included in the email sent to users as part of the built-in password reset flow. The email also adds a unique password reset token and tokenId as query parameters.

This URL should handle user confirmation by passing the password reset token to a Realm SDK's resetPassword function.

resetPasswordSubject string

The subject line of the email sent to users as part of the built-in password reset flow.

Hide attributes Show attributes

autoConfirm

If true, automatically confirm new user accounts without additional verification. For custom function account confirmation, set this value to false.

Value is false.

runConfirmationFunction boolean

If true, new email/password user account registrations use a custom function that you define to handle the confirmation process.

confirmationFunctionName string

The name of the custom function that handles the confirmation process.

runResetFunction boolean

If true, use a custom function that you define to handle the password reset process.

Value is true.

resetFunctionName string

The name of the custom function that handles the password reset process.
Hide attributes Show attributes

_id string

The authentication provider's unique ID.

name string Required

The name of the authentication provider. For API key authentication, this value is always api-key.

Value is api-key.

type string Required

The name of the authentication provider. For API key authentication, this value is always api-key.

Value is api-key.

disabled boolean

If true, the auth provider is disabled. Users cannot log in through the provider until it is enabled.
Hide attributes Show attributes

_id string

The authentication provider's unique ID.

name string Required

The name of the authentication provider. For Custom JWT authentication, this value is always custom-token.

Value is custom-token.

type string Required

The name of the authentication provider. For Custom JWT authentication, this value is always custom-token.

Value is custom-token.

disabled boolean

If true, the auth provider is disabled. Users cannot log in through the provider until it is enabled.

config object

A configuration object for the Custom JWT authentication provider.

Hide config attributes Show config attributes object

audience array[string]

Defines the expected values of the aud claim in the external JWT. By default, the Custom JWT provider expects aud to be your App ID.

requireAnyAudience string

If false, the external JWT must include all of the values defined in audience in its aud claim.

If true, a JWT is valid if any of the values defined in audience are in its aud claim.

Default value is false.

signingAlgorithm string

The cryptographic method that the external system uses to sign the JWT. Custom JWT authentication supports JWTs signed using any of the following algorithms:

HS256

RS256

useJWKURI boolean

If true, the Custom JWT provider uses a signing algorithm and signing keys defined in a JSON Web Key (JWK) or JSON Web Key Set (JWKS). The JWK(S) must be accessible at the URL specified in jwkURI.

jwkURI string

A URL that hosts a JWK or JWKS that describes the signing method and signing keys the Custom JWT provider should use. The JWK(S) may specify up to three signing keys and must use the RS256 algorithm.

secret_config object

Hide secret_config attribute Show secret_config attribute object

signingKeys array[string]

A list of the names of up to three Secrets that each contain a signing key used by the external authentication system to sign JWTs. Each signing key Secret must be a string with length between 32 and 512 characters.

metadata_fields array[object]

Metadata fields are additional data that describe each user. The value of each metadata field comes from some field included in the JWT from the external authentication system.

A user's metadata fields refresh whenever they log in.

A specific metadata field from the external JWT to include the user's data. This maps an external JWT field name (name) to the field name in the user's data (field_name) that holds the value of that field.

Hide metadata_fields attributes Show metadata_fields attributes object

required boolean

If true, this value must always be present in the external JWT.

name string

The name of the field in the external JWT that contains the data.

To specify a field in an embedded object, use dot notation.

field_name string

The name of the field in User object that holds the value.
Hide attributes Show attributes

_id string

The authentication provider's unique ID.

name string Required

The name of the authentication provider. For Custom Function authentication, this value is always custom-function.

Value is custom-function.

type string Required

The name of the authentication provider. For Custom Function authentication, this value is always custom-function.

Value is custom-function.

disabled boolean

If true, the auth provider is disabled. Users cannot log in through the provider until it is enabled.

config object

A configuration object for the Custom Function authentication provider.

Hide config attribute Show config attribute object

authFunctionName string

The name of the custom authentication function that handles user logins.
Hide attributes Show attributes

_id string

The authentication provider's unique ID.

name string Required

The name of the authentication provider. For Apple authentication, this value is always oauth2-apple.

Value is oauth2-apple.

type string Required

The name of the authentication provider. For Apple authentication, this value is always oauth2-apple.

Value is oauth2-apple.

disabled boolean

If true, the auth provider is disabled. Users cannot log in through the provider until it is enabled.

config object

A configuration object for the Apple authentication provider.

Hide config attribute Show config attribute object

clientId string

Your Apple Services ID.

To learn how to get this, see Create a Services ID.

secret_config object

Hide secret_config attribute Show secret_config attribute object

clientSecret string

The name of a Secret that holds your client secret JWT.

To learn how to create this, see Create the Client Secret JWT.

redirect_uris array[string]

A list of URIs that the OAuth flow should allow the user to redirect to.
Hide attributes Show attributes

_id string

The authentication provider's unique ID.

name string Required

The name of the authentication provider. For Google authentication, this value is always oauth2-google.

Value is oauth2-google.

type string Required

The name of the authentication provider. For Google authentication, this value is always oauth2-google.

Value is oauth2-google.

disabled boolean

If true, the auth provider is disabled. Users cannot log in through the provider until it is enabled.

config object

A configuration object for the Google authentication provider.

Hide config attributes Show config attributes object

clientId string

An OAuth 2.0 Client ID for your GCP project.

To learn how to create one, see Set Up a Project in the Google API Console.

openId boolean

An OAuth 2.0

secret_config object

Hide secret_config attribute Show secret_config attribute object

clientSecret string

The name of a Secret that holds the OAuth 2.0 Client Secret for the Client ID specified in config.clientId.

redirect_uris array[string]

A list of URIs that the OAuth flow should allow the user to redirect to.

metadata_fields array[array]

Metadata fields are additional data that describe each user. The value of each metadata field comes from Google and is included in the authenticated JWT.

A user's metadata fields refresh whenever they log in.

Hide metadata_fields attributes Show metadata_fields attributes object

required boolean

If true, include this metadata value in the OAuth JWT and the user's data.

name string

The name of a user metadata property accessible through OAuth, e.g. email.

domain_restrictions array[string]

A list of approved domain names for user accounts. If this is defined, a user must have an email address associated with their OAuth profile that has a domain included in this list.
Hide attributes Show attributes

_id string

The authentication provider's unique ID.

name string Required

The name of the authentication provider. For Facebook authentication, this value is always oauth2-facebook.

Value is oauth2-facebook.

type string Required

The name of the authentication provider. For Facebook authentication, this value is always oauth2-facebook.

Value is oauth2-facebook.

disabled boolean

If true, the auth provider is disabled. Users cannot log in through the provider until it is enabled.

config object

A configuration object for the Facebook authentication provider.

Hide config attribute Show config attribute object

clientId string

The App ID of your Facebook app.

secret_config object

Hide secret_config attribute Show secret_config attribute object

clientSecret string

The name of a Secret that holds your Facebook App Secret.

redirect_uris array[string]

A list of URIs that the OAuth flow should allow the user to redirect to.

metadata_fields array[array]

Metadata fields are additional data that describe each user. The value of each metadata field comes from Facebook and is included in the authenticated JWT.

A user's metadata fields refresh whenever they log in.

Hide metadata_fields attributes Show metadata_fields attributes object

required boolean

If true, include this metadata value in the OAuth JWT and the user's data.

name string

The name of a user metadata property accessible through OAuth, e.g. email.

domain_restrictions array[string]

A list of approved domain names for user accounts. If this is defined, a user must have an email address associated with their OAuth profile that has a domain included in this list.

GET /groups/{groupId}/apps/{appId}/auth_providers/{providerId}

curl \
 --request GET 'https://services.cloud.mongodb.com/api/admin/v3.0/groups/{groupId}/apps/{appId}/auth_providers/{providerId}' \
 --header "Authorization: Bearer $ACCESS_TOKEN"

Response examples (200)

{
  "_id": "string",
  "name": "anon-user",
  "type": "anon-user",
  "disabled": true
}

{
  "_id": "string",
  "name": "local-userpass",
  "type": "local-userpass",
  "disabled": true,
  "config": {
    "autoConfirm": true,
    "resetPasswordUrl": "string",
    "resetPasswordSubject": "string"
  }
}

{
  "_id": "string",
  "name": "api-key",
  "type": "api-key",
  "disabled": true
}

{
  "_id": "string",
  "name": "custom-token",
  "type": "custom-token",
  "disabled": true,
  "config": {
    "audience": [
      "string"
    ],
    "requireAnyAudience": false,
    "signingAlgorithm": "string",
    "useJWKURI": true,
    "jwkURI": "string"
  },
  "secret_config": {
    "signingKeys": [
      "string"
    ]
  },
  "metadata_fields": [
    {
      "required": true,
      "name": "string",
      "field_name": "string"
    }
  ]
}

{
  "_id": "string",
  "name": "custom-function",
  "type": "custom-function",
  "disabled": true,
  "config": {
    "authFunctionName": "string"
  }
}

{
  "_id": "string",
  "name": "oauth2-apple",
  "type": "oauth2-apple",
  "disabled": true,
  "config": {
    "clientId": "string"
  },
  "secret_config": {
    "clientSecret": "string"
  },
  "redirect_uris": [
    "string"
  ]
}

{
  "_id": "string",
  "name": "oauth2-google",
  "type": "oauth2-google",
  "disabled": true,
  "config": {
    "clientId": "string",
    "openId": true
  },
  "secret_config": {
    "clientSecret": "string"
  },
  "redirect_uris": [
    "string"
  ],
  "metadata_fields": [
    [
      {
        "required": true,
        "name": "string"
      }
    ]
  ],
  "domain_restrictions": [
    "string"
  ]
}

{
  "_id": "string",
  "name": "oauth2-facebook",
  "type": "oauth2-facebook",
  "disabled": true,
  "config": {
    "clientId": "string"
  },
  "secret_config": {
    "clientSecret": "string"
  },
  "redirect_uris": [
    "string"
  ],
  "metadata_fields": [
    [
      {
        "required": true,
        "name": "string"
      }
    ]
  ],
  "domain_restrictions": [
    "string"
  ]
}