Antylogic
DemoApp login

399 operational guides

Docs sections
DocsAuthentication
Device

How to list authentication providers

Check which public sign-in provider records the backend exposes before anyone signs in. This action returns JSON metadata only; it does not start OAuth, create a session, register a user, or depend on organisation, location, role, membership, or permission context.

In this article

The provider list is a public contract check for authentication setup. It tells the client which sign-in options can be discovered before a user opens a session.

Use this guide when validating login configuration or support evidence. Treat the response as public metadata, not as proof that an OAuth provider can complete login.

Before you start

  • The backend exposes `GET /api/app/auth/providers` through registered app auth routes.
  • The application repository exists and may contain zero or more `auth_providers` records.
  • The client or capture flow points `APP_API_BASE_URL` or `APP_WEB_URL` at the backend exposing `/api/app/auth/providers`.
  • No signed-in user, organisation, location, role, or permission selection is required.

Instructions

  1. 1.

    Open the public provider list

    Request `GET /api/app/auth/providers` from the application backend. For the GB documentation runtime, capture `${APP_WEB_URL}/api/app/auth/providers` directly.

  2. 2.

    Read the JSON records

    Review the returned array. Each provider item may expose only `code`, `name`, `authorization_endpoint`, `enabled`, and `scopes`.

  3. 3.

    Interpret availability carefully

    A provider with `enabled: false` can still appear in the list. The later OAuth start action is responsible for blocking disabled providers and validating the login flow.

  4. 4.

    Handle empty or failed responses

    An empty configured provider list is still a successful `[]` response. Non-`GET` methods return `HTTP 405`; repository or service lookup failures return `HTTP 500`.

Validations and limits

  • The request method must be `GET`; no body or query parameters are documented.
  • A successful response is `HTTP 200` with an array compatible with `AuthProviderPublic[]`.
  • The public response must not include `client_secret`, `client_id`, `token_endpoint`, `jwks_uri`, `userinfo_endpoint`, `issuer`, `config`, `created_at`, or `updated_at`.
  • If no providers are configured, document the successful empty array response as `[]`.
  • Do not document this action as a visual provider selector; the wrapper exists but no selector screen was found.
  • Do not scope examples to Harbor Demo Group, Harbor Soho, Harbor Borough, staff, reservations, TPV, or catalog data.

Expected result

The reader can verify the public authentication provider metadata available before sign-in while keeping private OAuth configuration and session behaviour out of the guide.

Related articles