Copy page

Configuration

Sign-in

The identity section gives your portal sign-in: accounts, the sign-up and sign-in pages, password reset and email verification. The console (plans, API keys, usage) needs it.

apitogo.config.json
{
  "identity": {}
}

"identity": {} uses APItoGo's sign-in service. apitogo deploy sets it up for your project, with its own address (https://id.apitogo.com/<project>), and connects the portal to it. Nothing else is needed.

Settings

Setting	Default	What it does
provider	apitogo	apitogo (the hosted sign-in service) or oidc (your own provider)
native	true	People can create an account with an email address and a password
connections	none	Sign in with another provider too, such as Microsoft or Google
providerOptions	none	Passwords, sign-up, MFA, branding (below)
clients	none	Extra apps that sign people in with the same accounts
issuer, clientId	none	With provider: "oidc": your provider's issuer and the portal's client id
enabled	true	false keeps the section but leaves sign-in out of deploys

Provider options

Code
"identity": {
  "providerOptions": {
    "signup": { "mode": "open", "allowedEmailDomains": ["example.com"] },
    "password": { "minLength": 12, "checkBreached": true },
    "mfa": { "mode": "optional" },
    "branding": { "logo": "https://example.com/logo.svg", "color": "#0d9488" }
  }
}

• signup.mode: open (anyone), invite (people you invite) or closed (nobody new). allowedEmailDomains limits sign-up to those domains.
• password: the shortest password allowed (8 to 128), and whether known-breached passwords are refused.
• mfa.mode: off, optional or required.
• branding: the logo and color of the sign-in pages and emails.
• customDomain: a hostname of your own for the sign-in pages, such as id.example.com.

Sign in with another provider

Add an OpenID Connect provider next to email and password. Its client secret is a project secret:

Code
"identity": {
  "connections": [
    {
      "id": "microsoft",
      "type": "oidc",
      "authority": "https://login.microsoftonline.com/<tenant>/v2.0",
      "clientId": "<client id>",
      "clientSecret": "secret:MICROSOFT_CLIENT_SECRET",
      "displayName": "Microsoft"
    }
  ]
}

Code
apitogo secrets set MICROSOFT_CLIENT_SECRET

Set "native": false to offer only the connections.

Your own OpenID Connect provider

If your users already have accounts somewhere else, point the portal at that provider instead:

Code
"identity": {
  "provider": "oidc",
  "issuer": "https://login.example.com",
  "clientId": "portal"
}

Register the portal in your provider with the redirect address https://<your-portal>/oauth/callback.

Use the same sign-in for your API

By default the gateway checks API keys. To have it check the signed-in person's token as well, set gateway.auth:

Code
"gateway": {
  "auth": { "mode": "identity" }
}

The API reference's Try it then also offers Signed-in user, which sends that token. See Gateway.

Local preview

apitogo run before the first deploy has no sign-in service yet. The console then signs in with a demo account, so you can try every page:

Code
demo@apitogo.local / password

The demo account exists only in a local preview, never in a deployed portal.