> ## Documentation Index
> Fetch the complete documentation index at: https://docs.partner-api.tryrima.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure OIDC

> Exchange OIDC settings and register Rima with your identity provider.

Rima must register your connection before OIDC sign-in can be tested.

Rima uses the OIDC authorization code flow with PKCE enabled by default. Start with [SSO setup](/sso-setup) for the Sandbox and production URLs and the `providerId` assigned to your connection.

## Exchange registration details

1. Give Rima your IdP issuer and discovery URL, plus the client ID assigned to Rima. Exchange any client secret through an agreed secure channel.
2. Use the client authentication method Rima supplies for your connection: `client_secret_basic` or `client_secret_post`.
3. Rima registers the connection and gives you its `providerId` and exact redirect URI. Add that URI to the matching Sandbox or production IdP registration.
4. Open the browser launch URL supplied by Rima and test with mapped identities after the connection is confirmed as ready.

## Identity claims

| Claim | Behavior |
| - | - |
| `sub` | Stable OIDC subject used to link repeat sign-ins to the same identity. |
| `email` | Nonempty email is required by the default mapping for first sign-in. |

Rima reads UserInfo when configured, otherwise the ID token. When UserInfo is used, its `sub` must match the ID token's `sub`.

First sign-in also depends on [Rima account and invitation access](/sso-access); a valid IdP response alone does not grant access.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.