> ## Documentation Index
> Fetch the complete documentation index at: https://docs.postqueen.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# OIDC Configuration

> How to configure OIDC for PostQueen

Point PostQueen at your own identity provider, so people sign in with the account they already
have rather than a new password here. This is worth doing if your organisation already runs
single sign-on, and is not needed otherwise.

<Note>
  This is about signing **into** PostQueen. Connecting social networks so she can post to them is
  a different thing entirely: see [Providers](/providers/overview).
</Note>

## Before you start

<Warning>
  **Two things to know before you start.**

  Your OIDC provider replaces the Google button, and the Farcaster and wallet buttons with it. It does not replace GitHub, because GitHub sign-in and OIDC can never appear together in the first place: GitHub renders only when `IS_GENERAL` is unset, and OIDC renders only when it is set.

  Which means `IS_GENERAL` has to be set for any of this to appear. Configure every variable below without it and the login page will look exactly as it did before, GitHub button and all. Nothing on this page will have taken effect.
</Warning>

## Setup

We will use [Authentik](https://goauthentik.io/) as an OIDC provider example, with base URL `https://authentik.example.com`

<Steps>
  <Step title="Create an Application/Provider on the Authentik side">
    You will find the following important information:

    * `redirect_uri` => `https://postqueen.example.com/settings`
    * `client_id` => `randomclientid`
    * `client_secret` => `randomclientsecret`
    * `auth_url` => `https://authentik.example.com/application/o/authorize`
    * `token_url` => `https://authentik.example.com/application/o/token`
    * `userinfo_url`=> `https://authentik.example.com/application/o/userinfo`

    <Note>
      OIDC is a standard, so the same values come from any OIDC provider. Okta, Microsoft Entra ID, Auth0 and Google Workspace all expose them, as do self-hosted providers such as Keycloak and Dex.
    </Note>
  </Step>

  <Step title="Configure POSTQUEEN_GENERIC_OAUTH">
    ```env theme={"system"}
    POSTQUEEN_GENERIC_OAUTH="true"
    ```

    Set to `true` to enable OIDC login.
  </Step>

  <Step title="Configure display name">
    ```env theme={"system"}
    NEXT_PUBLIC_POSTQUEEN_OAUTH_DISPLAY_NAME="Authentik"
    ```

    Will display the name of the OIDC provider on the login page.
  </Step>

  <Step title="Configure logo URL">
    ```env theme={"system"}
    NEXT_PUBLIC_POSTQUEEN_OAUTH_LOGO_URL="https://postqueen.example.com/sso-logo.png"
    ```

    Will display the logo of the OIDC provider on the login page button. Any publicly reachable image URL works.
  </Step>

  <Step title="Configure POSTQUEEN_OAUTH_AUTH_URL">
    ```env theme={"system"}
    POSTQUEEN_OAUTH_AUTH_URL="https://authentik.example.com/application/o/authorize/"
    ```

    The authorization URL of the OIDC provider.
  </Step>

  <Step title="Configure POSTQUEEN_OAUTH_TOKEN_URL">
    ```env theme={"system"}
    POSTQUEEN_OAUTH_TOKEN_URL="https://authentik.example.com/application/o/token/"
    ```

    The token URL of the OIDC provider.
  </Step>

  <Step title="Configure POSTQUEEN_OAUTH_USERINFO_URL">
    ```env theme={"system"}
    POSTQUEEN_OAUTH_USERINFO_URL="https://authentik.example.com/application/o/userinfo/"
    ```

    The userinfo URL of the OIDC provider.
  </Step>

  <Step title="Configure POSTQUEEN_OAUTH_CLIENT_ID">
    ```env theme={"system"}
    POSTQUEEN_OAUTH_CLIENT_ID="randomclientid"
    ```

    The client ID of the OIDC provider.
  </Step>

  <Step title="Configure POSTQUEEN_OAUTH_CLIENT_SECRET">
    ```env theme={"system"}
    POSTQUEEN_OAUTH_CLIENT_SECRET="randomclientsecret"
    ```

    The client secret of the OIDC provider.
  </Step>
</Steps>