Identity Federation (OAuth / OIDC)

Configure Limio Self-Service to authenticate users via an external identity provider and surface custom claims in the SDK.

Limio Self-Service can authenticate users via an external identity provider (IdP). This is typically done with OAuth 2.0 + OpenID Connect (OIDC).

What you get

• Users sign in with your IdP.

• Limio receives an ID token (JWT).

• Standard claims (like email, given_name) and custom claims flow through.

• In the SDK, you access these claims via useUser().

Claims and useUser()

useUser().attributes is the decoded claims object. Anything your IdP includes in the token can appear here.

Typical examples:

• email

• email_verified

• given_name

• family_name

• custom claims like crm_id

Claim names and shapes depend on your IdP and configuration. Treat them as untrusted input. Validate before use.

Implementation outline

1

Configure your IdP application

Create an OIDC client in your IdP. Record the client settings you’ll need later:

• Client ID

• Client secret (if applicable)

• Issuer URL

• Authorization endpoint

• Token endpoint

• JWKS URL

2

Configure redirect URIs

Add your Limio Self-Service callback URL(s) to the IdP client. The exact callback URL is environment-specific.

3

Decide which claims you need

Define which standard and custom claims must be present. If you need custom claims, configure them in the IdP token.

Example: add crm_id to the ID token.

4

Enable federation in your Limio environment

Apply the IdP settings to your Limio environment. This step is usually done with Limio Support.

Related docs

• External Identities API

Identity federation (SSO) and the External Identities API solve different problems. Federation authenticates a user. External identities link multiple user identities to the same customer/subscription.