GET /v1/oauth_providers

oauth_providers:read

List the social sign-in provider catalog with which are configured/enabled and each derived redirect URI. Never returns a client secret.

GET /v1/oauth_providers/:provider

oauth_providers:read

Fetch one social sign-in provider: its catalog entry and configured state, no secret.

PUT /v1/oauth_providers/:provider

oauth_providers:write

✓

Set a social sign-in provider's client id/secret (and scopes/settings). The secret is write-only and stored encrypted; pasting your own clears the shared-dev-keys flag.

POST /v1/oauth_providers/:provider/enabled

oauth_providers:write

Enable or disable a social sign-in provider. Enabling one with no credentials is refused.

POST /v1/oauth_providers/:provider/scope

oauth_providers:write

Scope a provider to sign-in, sign-up, or both (allow_sign_in / allow_sign_up). Enforced at the resolver, so a sign-in-only provider never JIT-creates an account. Refuses "neither" — disable the provider instead.

POST /v1/oauth_providers/:provider/test

oauth_providers:read

Test a social sign-in provider's stored credentials against the provider's token endpoint. Proves the client id/secret only, not redirect-URI registration or scope approval.

DELETE /v1/oauth_providers/:provider

oauth_providers:write

Remove a social sign-in provider’s credentials. Existing linked accounts are preserved.