> For the complete documentation index, see [llms.txt](https://docs.oceanenterprise.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.oceanenterprise.io/infrastructure/marketplace-installation-and-configuration/configure-market-level-authentication/configure-the-authentik-provider-and-application.md).

# Configure the Authentik provider and application

## Log in to the Authentik Admin console

1\. Open your Authentik admin panel

Example: `https://your-authentik-domain:8443`

2\. Log in using an administrator account.

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FaFfp1AGMYkhdX284QsrH%2Fimage.png?alt=media&amp;token=cd2653df-7f34-4060-a182-92f4d100e25b" alt=""><figcaption></figcaption></figure>

## Create an OAuth2 / OIDC provider

1\. In the Authentik admin panel, navigate to `Applications → Providers`

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FTd8mI01d8RAGF6fLQOAI%2Fimage.png?alt=media&amp;token=348c7caa-1165-4fb1-bd96-1960a794fa83" alt=""><figcaption></figcaption></figure>

2\. Select `Create`

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FpKEcchcPVRRTFurkPxpC%2Fimage.png?alt=media&amp;token=1d4b0a83-a18e-4f85-88ca-af3486808484" alt=""><figcaption></figcaption></figure>

3\. Select `OAuth2 / OpenID Provider`

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2F0C2h1t52UexZCY9qvrnP%2Fimage.png?alt=media&amp;token=60f059a2-ff18-4fa3-a0c5-13bb9aaa8361" alt=""><figcaption></figcaption></figure>

## Configure the provider

4\. Press Next and enter the following configuration:

**Basic Configuration**

* Name: `ocean-market-provider`
* Authorization Flow: `default-provider-authorization-implicit-consent`

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FCW39W2MaAcw2dIeKDHQ1%2Fimage.png?alt=media&amp;token=155ef1c7-9c8c-4bb1-a87b-4e1cf4227963" alt=""><figcaption></figcaption></figure>

***

**Protocol settings**

* Client Type: `Confidential`
* Client ID: Use the generated value
* Client Secret: Use the generated value
* Redirect URIs
  * Add the Ocean Market callback URL: `https://market.example.com/auth/callback`
  * Use `Strict Matching`

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FAswwRfmqQ0Clktdz8vhD%2Fimage.png?alt=media&amp;token=673ac9dc-7d95-4781-9733-4c6fee815253" alt=""><figcaption></figcaption></figure>

* Signing Key: select the key associated with the qualified certificate configured in Authentik

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2Fnqk8D1uryLTUtR667NpO%2Fimage.png?alt=media&amp;token=53ed3b64-62c5-4913-ae80-d3a9e2d59203" alt=""><figcaption></figcaption></figure>

***

**Advanced flow settings**

* Authentication flow: `default-authentication-flow`
* Invalidation flow: use the default setting

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FdxFkbfTsr3sZN6d2erLM%2Fimage.png?alt=media&amp;token=0bc1eff3-61cd-44d2-a0b3-d6cf8363c851" alt=""><figcaption></figcaption></figure>

***

**Advanced protocol settings**

* Scopes: add the following to Selected Scopes
  * openid
  * profile
  * email
  * offline\_access

These scopes allow OE Marketplace to retrieve user identity information

***

5\. Click Finish to save the provider

***

## Create the Ocean Market Application

1\. Navigate to `Applications->Applications`

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FkCeWgnnttD4jI531Iq15%2Fimage.png?alt=media&amp;token=8b9b659e-0942-4737-ac86-6702d21ee6fa" alt=""><figcaption></figcaption></figure>

2\. Click Create and enter the following information:

* Application Name: `Ocean Market`
* Slug:`ocean-market`&#x20;
* Provider: `ocean-market-provider`

<figure><img src="https://1789397093-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FH0zpgrXbeZ7u6UuCV9Gz%2Fuploads%2FqOA0ruHtGCSn4hAwfQUr%2Fimage.png?alt=media&amp;token=f54d9b15-0c3b-4405-ace5-5943a9510544" alt=""><figcaption></figcaption></figure>

3\. Click Create

***

## Retrieve OIDC Credentials

1\. Click the created provider

2\. Copy the following values

* Client ID
* Client Secret (displayed only in Edit mode)
* OpenID Configuration Issuer (example: `https://ocean-node-vm2.oceanenterprise.io:8443/application/o/ocean-market/`)
* OpenID Token URL (example: `https://ocean-node-vm2.oceanenterprise.io:8443/application/o/token/`)

These values are required in the Ocean Market environment configuration.

***

## Verify the OIDC Configuration

1\. Open the provider discovery endpoint (`https://your-authentik-domain:8443/application/o/ocean-market/.well-known/openid-configuration`)

2\. If configured correctly, Authentik returns the OIDC metadata as JSON. This confirms that the provider is correctly configured.