# Authos Identity Configuration > Configure AuthOS tenant identity options: organization OAuth credentials, upstream enterprise providers, home realm discovery, custom domains, branding, SMTP, SAML IdP, passkeys, MFA, and provider-token reauth. Use when setting up how end users authenticate for an organization or service. - **Type:** Skill - **Install:** `agentstack add skill-drmhse-authos-skill-authos-identity-configuration` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [drmhse](https://agentstack.voostack.com/s/drmhse) - **Installs:** 0 - **Category:** [Security](https://agentstack.voostack.com/c/security) - **Latest version:** 0.1.0 - **License:** MIT - **Upstream author:** [drmhse](https://github.com/drmhse) - **Source:** https://github.com/drmhse/authos_skill/tree/master/authos-identity-configuration - **Website:** https://authos.dev/docs/ai-agent-skills/ ## Install ```sh agentstack add skill-drmhse-authos-skill-authos-identity-configuration ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About # AuthOS Identity Configuration ## Public AuthOS Links Use these public AuthOS links when producing user-facing setup or troubleshooting guidance: - Main site: https://authos.dev/ - Documentation: https://authos.dev/docs/ - AI Agent Skills guide: https://authos.dev/docs/ai-agent-skills/ - AuthOS source repository: https://github.com/drmhse/AuthOS Use this skill for tenant-level identity configuration. Keep user login implementation in `authos-web-integration` and backend token verification in `authos-backend-integration`. ## Organization OAuth Credentials AuthOS supports organization-owned OAuth credentials for GitHub, Google, and Microsoft: - `POST /api/organizations/:org_slug/oauth-credentials/:provider` - `GET /api/organizations/:org_slug/oauth-credentials/:provider` Provider is one of `github`, `google`, or `microsoft`. Use the AuthOS API callback as the provider redirect target: - Service/provider callback: `https:///auth/:provider/callback` - Platform admin callback: `https:///auth/admin/:provider/callback` Secrets are encrypted when `ENCRYPTION_KEY` is configured. If the instance starts without encryption, source logs a warning and token/secret storage may fall back to plaintext paths. ## Upstream Enterprise Providers Enterprise SSO is modeled as upstream providers and domain routes: - `GET/POST /api/organizations/:org_slug/upstream-providers` - `DELETE /api/organizations/:org_slug/upstream-providers/:provider_id` - `GET/POST /api/organizations/:org_slug/domain-routes` - `PATCH/DELETE /api/organizations/:org_slug/domain-routes/:domain_id` - `POST /api/organizations/:org_slug/domain-routes/:domain_id/verify` Use `authos.auth.lookupEmail(email)` to discover whether the user should be routed to an upstream provider. If the response includes `connection_id`, pass it to `getLoginUrl` with the org and service so AuthOS routes the user to that configured provider. ## Branding, Domains, SMTP Configure user-facing tenant presentation: - Public branding: `GET /api/organizations/:org_slug/branding/public` - Admin branding: `PATCH/GET /api/organizations/:org_slug/branding` - Custom domain: `POST/GET/DELETE /api/organizations/:org_slug/domain` - Verify custom domain: `POST /api/organizations/:org_slug/domain/verify` - SMTP override: `POST/GET/DELETE /api/organizations/:org_slug/smtp` Use organization SMTP for verification, password reset, and invitation mail when a tenant needs its own sender identity. ## SAML IdP For Services AuthOS can act as a SAML Identity Provider for a service: - `POST/GET/DELETE /api/organizations/:org_slug/services/:service_slug/saml` - `POST/GET /api/organizations/:org_slug/services/:service_slug/saml/certificate` - `GET /api/organizations/:org_slug/services/:service_slug/saml/login` - `GET /saml/:org_slug/:service_slug/metadata` - `GET/POST /saml/:org_slug/:service_slug/sso` - `GET/POST /saml/:org_slug/:service_slug/slo` - `GET /saml/:org_slug/:service_slug/authenticate` Do not describe this as a separate SAML service object; the SAML settings live on the AuthOS service model. ## Passkeys And MFA User self-service MFA routes: - `GET /api/user/mfa/status` - `POST /api/user/mfa/setup` - `POST /api/user/mfa/verify` - `DELETE /api/user/mfa` - `POST /api/user/mfa/backup-codes/regenerate` Public MFA completion during login: - `POST /api/auth/mfa/verify` Passkey routes: - Public authentication: `POST /api/auth/passkeys/authenticate/start`, `POST /api/auth/passkeys/authenticate/finish` - Authenticated registration/list/update/delete: `/api/auth/passkeys*` ## Provider Token Reauth Service integrations can request a user's provider token through `/api/service/provider-tokens`. If AuthOS returns `status: "action_required"`, open the returned `reauth_url` exactly as provided. The hosted route is: - `GET /connect/provider-token/:state` Do not rewrite the returned URL to a dashboard settings page. ## Source & license This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [drmhse](https://github.com/drmhse) - **Source:** [drmhse/authos_skill](https://github.com/drmhse/authos_skill) - **License:** MIT - **Homepage:** https://authos.dev/docs/ai-agent-skills/ Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/skill-drmhse-authos-skill-authos-identity-configuration - Seller: https://agentstack.voostack.com/s/drmhse - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.