OIDC Configuration

OpenID Connect (OIDC) integration allows connecting Portabase to any compatible identity provider, such as Keycloak, Auth0, Authentik, or Okta.

Implementation

To configure an OIDC provider, you must define a set of environment variables starting with AUTH_OIDC_.

Create the Client

On your identity server (e.g., Keycloak), create a new client of type "OIDC" or "OpenID Connect".

Configure URLs

Define the redirect URL (Redirect URI): https://<your-domain>/api/auth/sso/callback/<providerId>

Enter Variables

Add the credentials obtained into your Portabase configuration.

Configure with the CLI

If the dashboard was created with the Portabase CLI, add the provider with portabase dashboard auth add. It writes the AUTH_OIDC_<ID>_* variables for you.

# The callback needs a public URL
portabase dashboard set ./my-dashboard url https://backup.example.com

printf '%s\n' "$OIDC_SECRET" | portabase dashboard auth add ./my-dashboard oidc keycloak \
  --issuer https://sso.example.com/realms/main \
  --client portabase --secret-stdin \
  --title "Company SSO" --scopes "openid profile email" --pkce

portabase restart ./my-dashboard

Option	Variable
provider id (argument)	`AUTH_OIDC_<ID>_ID`
`--issuer`	`AUTH_OIDC_<ID>_ISSUER_URL`
`--client`	`AUTH_OIDC_<ID>_CLIENT`
`--secret` / `--secret-stdin`	`AUTH_OIDC_<ID>_SECRET`
`--title`	`AUTH_OIDC_<ID>_TITLE`
`--scopes`	`AUTH_OIDC_<ID>_SCOPES`
`--pkce`	`AUTH_OIDC_<ID>_PKCE`
`--host`	`AUTH_OIDC_<ID>_HOST`

List and remove providers with portabase dashboard auth list and portabase dashboard auth remove. Restrict access to a group with portabase dashboard set ./my-dashboard allowed_group <group>.

AUTH_OIDC_<ID>_DESC and AUTH_OIDC_<ID>_ICON are not handled by the CLI: add them to .env by hand.

Provider Settings

Prop

Type

Linking a provider to an existing account is controlled by AUTH_ALLOW_LINKING, and a user's ability to detach it afterwards by AUTH_ALLOW_UNLINKING. Both are described in Account Linking.

Multiple Providers

Portabase supports configuring multiple OIDC providers simultaneously. To do this, replace the AUTH_OIDC_ prefix with AUTH_OIDC_<NAME>_.

Example with Pocket

AUTH_OIDC_POCKET_ID="portabase-pocketid"
AUTH_OIDC_POCKET_TITLE="Pocket ID"
AUTH_OIDC_POCKET_DESC=""
AUTH_OIDC_POCKET_ICON="https://github.com/user-attachments/assets/4ceb2708-9f29-4694-b797-be833efce17d"
AUTH_OIDC_POCKET_CLIENT="portabase"
AUTH_OIDC_POCKET_SECRET="dkNOnQwhDQVwLxoNbQOkJioMA3sQIPdk"
AUTH_OIDC_POCKET_ISSUER_URL="http://localhost:3055"
AUTH_OIDC_POCKET_HOST="localhost:8080"

Using a specific prefix allows isolating configurations if you use multiple identity servers.

Configuration Examples

Learn how to integrate specific solutions:

Learn how to configure Keycloak with Portabase for enterprise identity management. View the full guide

Groups and Roles

You can restrict Portabase access to a specific group from your OIDC provider via the ALLOWED_GROUP variable. If the user does not belong to this group, login will be denied.

On this page