Skip to content

Target Audience: Administrators

OpenID Connect

Payway uses OpenID Connect in two directions, both managed under Security → OpenID Connect in PAP. The distinction is which side is the OpenID Provider (OP) — the party that authenticates the user and issues the identity — and which is the Relying Party (RP) — the client application that relies on the OP to sign the user in:

Payway's role The other side Where
Payway as an identity provider OpenID Provider (OP) applications that sign users in with a Payway account — they are the Relying Parties (clients) this section + API Users
External identity providers Relying Party (RP) — the client Google, Microsoft, Apple — they are the OpenID Providers this section + Sign in with an external provider

Payway as an identity provider

Payway is an OpenID Connect provider: other applications authenticate users with their Payway account. The Payway as an identity provider tab is a read-only reference — it shows the discovery document (/.well-known/openid-configuration) and the endpoints, scopes and claims an integration uses, and lists the API users configured as OpenID clients.

The actual per-application configuration lives on the API user (redirect URL, grant types, PKCE) — see API Users → Implementing the OpenID Standard. Full integration details and environment endpoint URLs are in the OpenID Connect integration documentation.

External identity providers

Lets your users sign in with an existing Google, Microsoft or Apple account instead of a password — i.e. social login. Here Payway is the relying party (client); the external providers are the OPs. The External identity providers tab lists the org's configured providers; the provider client ids and secrets are configured per organisation by Adeprimo and never leave Payway.

  • API Users — enable an API user as an OpenID client (OP) and grant its scopes.
  • External connections — a customer's external IDs and connected social logins.