# Connect an identity provider

A step of the [Cloud application](https://gradus.kazet.blog/tree/cloud-application) tree on Gradus, in the Security area: Secrets, auth, TLS, input.

Page: https://gradus.kazet.blog/tree/cloud-application/step/connect-identity-provider

Create the provider's tenant for each environment, register the callback URLs and keep its secrets out of the code.

One option of Sign-in: Hosted identity provider. The others: Passwords you own.

Usually comes after: [Choose how users sign in](https://gradus.kazet.blog/tree/cloud-application/step/choose-sign-in).

Leads to: [Verify provider tokens](https://gradus.kazet.blog/tree/cloud-application/step/verify-provider-tokens).

## Prompt for your AI assistant

```
Read the sign-in decision record in docs/decisions. Set up the hosted identity provider it names: a separate tenant or project per environment, the allowed callback, sign-out and origin URLs for each and its settings in the infrastructure code where the provider supports that. Keep client secrets as secrets. Turn on sign-in with required address verification, send its mail from the product's own domain and add each environment's values to the config module, so the service refuses to start without them. List in the decision record what the provider now owns: reset, verification, MFA and the mail it sends.
```

Every step of the tree: https://gradus.kazet.blog/tree/cloud-application/llms.txt