āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā ā š shadcn/directory/clerk/clerk-docs/guides/configure/auth-strategies/social-connections/custom-provider ā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā
<TutorialHero beforeYouStart={[ { title: "A Clerk application is required.", link: "/docs/getting-started/quickstart/setup-clerk", icon: "clerk", }, { title: "An OIDC identity provider is required.", link: "https://openid.net/specs/openid-connect-core-1_0.html", icon: "user-circle", } ]} />
Clerk allows you to configure custom OpenID Connect (OIDC) compatible authentication providers for your application. This guide walks you through the steps to set up a custom OAuth provider.
The provider is now configured but not yet enabled. On the connection's configuration page, find the Authorized redirect URLs to configure in your provider's settings.
Enable the provider either from the provider list or the top of the details page when ready.
If your provider returns claims in a non-standard format:
Sometimes attribute mapping isn't enough to get a provider working. For example, the call to the User info URL might require additional credentials or API calls. In these instances you should implement a proxy between Clerk and the provider to handle these transformations. The proxy will then be set as the User info URL.
The proxy receives the request from Clerk (which contains an Authorization header) and should return a JSON object which you can use for attribute mapping.
Initialize a new Hono + Cloudflare Workers project
Implement your proxy logic, e.g. making an additional API call. Here's a minimal example:
import { Hono } from 'hono'
const app = new Hono()
app.get('/', async (c) => {
const authorization = c.req.header('authorization')
const userRes = await fetch('https://api.com/user', {
headers: {
'Content-Type': 'application/json',
Authorization: authorization,
'api-key': 'some-api-key',
},
})
const user = await userRes.json()
return c.json({
uuid: user.uuid,
avatar_url: user.avatar,
name: user.name,
username: user.username,
slug: user.id.slug,
})
})
export default app
Deploy your proxy
Set the URL of the deployed Cloudflare worker as the User info URL
Map the returned claim format of the proxy to the respective attributes in the Attribute mapping section
Currently, Clerk doesn't support custom SSO providers with Proof Key for Code Exchange (PKCE).
ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā