Step 1 of 2

Connect your identity provider

This gateway has no accounts of its own — people sign in through your OIDC provider. Enter it below and we will try a real sign-in before saving anything.

Public URL of this gatewayThe address your users will open. It must match exactly, including https, because sign-in redirects are built from it.

Whitelist this redirect URI in your provider

https://llm.yachtos.app/auth/callback

Add it to the client's allowed redirect URIs before continuing. A provider that does not recognise it will refuse the sign-in.

Issuer URLCopy it exactly as your provider reports it — the trailing slash matters. Keycloak omits it, Authentik expects it.

Client IDClient secret

ScopesSpace-separated. openid is always requested. Keep the one that carries group membership.Group claimWhich claim lists a user's groups. Unsure? Leave it and pick from your own token on the next screen.

Nothing is saved yet. You will come back here after signing in.