# Configuration: Authorization Tab
This tab supports organizations that use OpenID Connect (OIDC) authorization protocols with the Incode Platform. You can view information about your existing OIDC authorization protocols from this tab.
| field | Description |
| --- | --- |
| Name | Shows the protocol name. |
| Client ID | Displays the client identifier (ID) generated by Incode. |
| Auth Methods | Displays one or more of these values based on the selections made when the protocol was generated: client secret basic, client secret post, client secret jwt, private key jwt, or none |
| Auth Grant Types | Displays one or more of these values based on the selections made when the protocol was generated: authorization code, refresh token, client credentials |
| Authentication Type | Displays one or more of these values based on the selections made when the protocol was generated: Face authentication, Onboarding, IncodeID, or Okta |
| Login Hint Type | Contains one of these values depending on the selections made when the protocol was generated: None, Unique ID, Phone, Email, or National Number |
| Login Attempt Limit | Displays the number of times a user can attempt to log in. The default and minimum value is *1* and the maximum value is *10* . |
| Redirect URIs | Shows one or more URIs users are redirected to for OIDC authentication. |
| Post Redirect URIs | Shows one or more URIs users are redirected to after their OIDC authentication is complete. |
| Scopes | Displays one or more of the scopes for which this protocol is used, based on the selections made when the protocol was generated.: openid, profile, email, address, selfie, selfie_attestation, fr_attestation, id_attestation, incode_id, roles, or scoring_results |
| Settings | Displays one or more settings for this protocol, based on the selections made when the protocol was generated: require-authorization-consent or require-proof-key |
| Authentication Signing Algorithm | Contains one of these values depending on the selection made when the protocol was generated: HS256, HS384, HS512, RS256, RS384, RS512, ES256, ES384, ES512, PS256, PS384, or PS512 |
| JWK Set URL | Shows the URL for a JWK set. |
| Actions | Provides icons so you can **Edit** or **Delete** the protocol. |
On the Authorization tab, you can also:
- Generate new authorization protocols
- Edit existing protocols
- Delete existing protocols
***
## Generate New Authorization Protocol
| field | Description |
| --- | --- |
| ConfigurationName | Allows you to enter the protocol name. |
| Issuer URL | Displays a URL generated by Incode. You cannot edit this field, but you can copy the URL shown. |
| Authorize URL | Displays a URL generated by Incode. You cannot edit this field, but you can copy the URL shown. |
| Token URL | Displays a URL generated by Incode. You cannot edit this field, but you can copy the URL shown. |
| Client ID | Displays the client identifier (ID) generated by Incode. You cannot edit this field, but you can copy the ID. |
| Client Secret | Displays a secure secret generated by Incode. You cannot edit this secret, but you can copy the secret shown. You can also click **Generate** to create an entirely new secret. |
| Authentication Type | Drop-down of authentication types that can be supported with an OIDC protocol. Selections in this field may dynamically add fields when you are generating a new protocol: **Face authentication** adds ***Login Hint Type***, ***Enable Sign Up Flow***, and ***Login Attempt Limit***. Selecting ***Enable Sign Up Flow*** dynamically adds ***Flow Type***, which then adds ***Flow*** or ***Workflow***. **Onboarding** adds ***Flow Type***, which then adds ***Flow*** or ***Workflow***; ***Okta Issue URL***; and ***Okta API Token***. **IncodeID** does not add any fields. **Okta** adds ***Registration ID***. |
| Login Hint | Drop-down of the following login hint values supported with an OIDC protocol: **None**, **Unique ID**, **Phone**, **Email**, or **National Number**. |
| Enable Sign Up Flow | Appears only when ***Authentication Type*** is set to *Face Authentication*. When selected, the ***Flow Type*** field displays. |
| Login Attempt Limit | Appears only when ***Authentication Type*** is set to *Face Authentication*. It lets you specify the number of times a user can attempt to log in. The default and minimum value is *1* and the maximum value is *10*. |
| Flow Type | Allows you to select whether you want to use a Flow or a Workflow for this protocol. This field appears only when one of the following is met: ***Authentication Type*** is set to *Face Authentication*, ***Enable Signup Flow*** is selected, and ***Flow Type*** is set to *Workflow*. ***Authentication Type*** is set to *Onboarding*. |
| Flow | Allows you to select from a drop-down of your existing Flows. This field appears only when one of the following is met: ***Authentication Type*** is set to *Face Authentication*, ***Enable Sign Up Flow*** is selected, and ***Flow Type*** is set to *Flow*. ***Authentication Type*** is set to *Onboarding* and ***Flow Type*** is set to *Flow*. |
| Workflow | Allows you to select from a drop-down of your existing Workflows. This field appears only when one of the following is met: ***Authentication Type*** is set to *Face Authentication*, ***Enable Sign Up Flow*** is selected, and ***Flow Type*** is set to *Workflow*. ***Authentication Type*** is set to *Onboarding* and ***Flow Type*** is set to *Workflow*. |
| Okta Issue URL | Appears only when ***Authentication Type*** is set to *Onboarding*. |
| Okta API Token | Appears only when ***Authentication Type*** is set to *Onboarding*. |
| Registration ID | Appears only when ***Authentication Type*** is set to *Okta*. |
| Redirect URIs | Allows you to enter one or more URIs to which users are redirected for OIDC authentication. |
| Post Logout Redirect URIs | Allows you to enter one or more URIs to which users are redirected after their OIDC authentication is complete. |
| Client Authentication Methods | Allows you to select or clear one or more of the following values when you create or edit a protocol: **client_secret_basic**, **client_secret_post**, **client_secret_jwt**, **private_key_jwt**, or **none**. |
| Authorization Grant Types | Allows you to select or clear one or more of the following values when you create or edit a protocol: **authorization_code** (this type is selected by default and cannot be cleared), **refresh_token**, or **client_credentials**. |
| Scopes | Allows you to define one or more of these supported scopes for which this protocol will be used: **openid** (this scope is selected by default and cannot be cleared), **profile**, **email**, **address**, **phone**, **selfie**, **selfie_attestation**, **fr_attestation**, **id_attestation**, **incode_id**, **roles**, and **scoring_results**. |
| Settings | Allows you to define one or more of these settings for this protocol: **require-authorization-consent** and **require-proof-key**. |
| Token Endpoint Authentication Signing Algorithm | Drop-down of the following supported signing algorithms: **HS256**, **HS384**, **HS512**, **RS256**, **RS384**, **RS512**, **ES256**, **ES384**, **ES512**, **PS256**, **PS384**, and **PS512**. |
| JWK Set URL | Allows you to enter the URL for a JWK set. |
| Authorize Generated URL | Displays a URL generated by Incode. You cannot edit this field, but you can copy the URL shown. |
1. In the left menu, click **Configuration**.
2. Click the **Authorization** tab.
3. Click **Generate New** in the lower right corner to open the Client Configuration dialog.
4. Enter a **_Configuration Name_**.
5. Select an **_Authentication Type_** from the drop-down of supported types. Your selection may cause additional fields to appear in the dialog. Refer to the table in the drop-down above for descriptions of these fields.
6. Enter one or more valid **_Redirect URIs_**.
7. Enter one or more valid **_Post Logout Redirect URIs_** if applicable.
8. Select the checkboxes for any **_Client Authentication Methods_** this protocol will support.
9. Select the checkboxes for any **_Authorization Grant Types_** this protocol will support.
10. Select the checkboxes for the **_Scopes_** this protocol will support.
11. Select the checkboxes for the **_Settings_** this protocol will support.
12. Use the drop-down to select a supported **_Token Endpoint Authentication Signing Algorithm_** if applicable.
13. Enter a valid **_JWK Set URL_** if applicable.
14. When you are finished with your configuration, click **Save**.
***
## Edit Existing Authorization Protocol
| field | Description |
| --- | --- |
| ConfigurationName | Allows you to enter the protocol name. |
| Issuer URL | Displays a URL generated by Incode. You cannot edit this field, but you can copy the URL shown. |
| Authorize URL | Displays a URL generated by Incode. You cannot edit this field, but you can copy the URL shown. |
| Token URL | Displays a URL generated by Incode. You cannot edit this field, but you can copy the URL shown. |
| Client ID | Displays the client identifier (ID) generated by Incode. You cannot edit this field, but you can copy the ID. |
| Client Secret | Displays a secure secret generated by Incode. You cannot edit this secret, but you can copy the secret shown. You can also click **Generate** to create an entirely new secret. |
| Authentication Type | Drop-down of authentication types that can be supported with an OIDC protocol. Selections in this field may dynamically add fields when you are generating a new protocol: **Face authentication** adds ***Login Hint Type***, ***Enable Sign Up Flow***, and ***Login Attempt Limit***. Selecting ***Enable Sign Up Flow*** dynamically adds ***Flow Type***, which then adds ***Flow*** or ***Workflow***. **Onboarding** adds ***Flow Type***, which then adds ***Flow*** or ***Workflow***; ***Okta Issue URL***; and ***Okta API Token***. **IncodeID** does not add any fields. **Okta** adds ***Registration ID***. |
| Login Hint | Drop-down of the following login hint values supported with an OIDC protocol: **None**, **Unique ID**, **Phone**, **Email**, or **National Number**. |
| Enable Sign Up Flow | Appears only when ***Authentication Type*** is set to *Face Authentication*. When selected, the ***Flow Type*** field displays. |
| Login Attempt Limit | Appears only when ***Authentication Type*** is set to *Face Authentication*. It lets you specify the number of times a user can attempt to log in. The default and minimum value is *1* and the maximum value is *10*. |
| Flow Type | Allows you to select whether you want to use a Flow or a Workflow for this protocol. This field appears only when one of the following is met: ***Authentication Type*** is set to *Face Authentication*, ***Enable Signup Flow*** is selected, and ***Flow Type*** is set to *Workflow*. ***Authentication Type*** is set to *Onboarding*. |
| Flow | Allows you to select from a drop-down of your existing Flows. This field appears only when one of the following is met: ***Authentication Type*** is set to *Face Authentication*, ***Enable Sign Up Flow*** is selected, and ***Flow Type*** is set to *Flow*. ***Authentication Type*** is set to *Onboarding* and ***Flow Type*** is set to *Flow*. |
| Workflow | Allows you to select from a drop-down of your existing Workflows. This field appears only when one of the following is met: ***Authentication Type*** is set to *Face Authentication*, ***Enable Sign Up Flow*** is selected, and ***Flow Type*** is set to *Workflow*. ***Authentication Type*** is set to *Onboarding* and ***Flow Type*** is set to *Workflow*. |
| Okta Issue URL | Appears only when ***Authentication Type*** is set to *Onboarding*. |
| Okta API Token | Appears only when ***Authentication Type*** is set to *Onboarding*. |
| Registration ID | Appears only when ***Authentication Type*** is set to *Okta*. |
| Redirect URIs | Allows you to enter one or more URIs to which users are redirected for OIDC authentication. |
| Post Logout Redirect URIs | Allows you to enter one or more URIs to which users are redirected after their OIDC authentication is complete. |
| Client Authentication Methods | Allows you to select or clear one or more of the following values when you create or edit a protocol: **client_secret_basic**, **client_secret_post**, **client_secret_jwt**, **private_key_jwt**, or **none**. |
| Authorization Grant Types | Allows you to select or clear one or more of the following values when you create or edit a protocol: **authorization_code** (this type is selected by default and cannot be cleared), **refresh_token**, or **client_credentials**. |
| Scopes | Allows you to define one or more of these supported scopes for which this protocol will be used: **openid** (this scope is selected by default and cannot be cleared), **profile**, **email**, **address**, **phone**, **selfie**, **selfie_attestation**, **fr_attestation**, **id_attestation**, **incode_id**, **roles**, and **scoring_results**. |
| Settings | Allows you to define one or more of these settings for this protocol: **require-authorization-consent** and **require-proof-key**. |
| Token Endpoint Authentication Signing Algorithm | Drop-down of the following supported signing algorithms: **HS256**, **HS384**, **HS512**, **RS256**, **RS384**, **RS512**, **ES256**, **ES384**, **ES512**, **PS256**, **PS384**, and **PS512**. |
| JWK Set URL | Allows you to enter the URL for a JWK set. |
| Authorize Generated URL | Displays a URL generated by Incode. You cannot edit this field, but you can copy the URL shown. |
1. In the left menu, click **Configuration**.
2. Click the **Authorization** tab.
3. In the OIDC Authorization table, locate the protocol you want, scroll to the Actions column on the far right, and click **Edit**.
4. Edit the fields and settings as needed.
5. When you are finished with your changes, click **Save**.
***
## Delete Existing Authorization Protocol
1. In the left menu, click **Configuration**.
2. Click the **Authorization** tab.
3. In the OIDC Authorization table, locate the protocol you want, scroll to the Actions column on the far right, and click **Delete**.
4. In the confirmation dialog, click **Confirm**.