> ## Documentation Index
> Fetch the complete documentation index at: https://docs.raily.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Providers

> Add a sign-in provider so only authenticated users can reach your AI Endpoints

Every AI Endpoint requires a sign-in. A **provider** is the identity service your users authenticate with before they can search. You manage providers in **Identities → Providers**, then attach one to each endpoint.

Raily supports OAuth 2.0 and OpenID Connect providers. Use Raily's own hosted sign-in, or bring your own from Google, Azure AD, Auth0, or any custom OAuth provider.

<Note>
  Adding, editing, or testing a provider is on the paid plan. On a trial you'll see "Upgrade your plan to add identity providers."
</Note>

## Providers you can add

<CardGroup cols={2}>
  <Card title="Raily" icon="shield-check">
    Raily-hosted sign-in. No credentials to set up; it's ready to use right away.
  </Card>

  <Card title="Google" icon="google">
    Your Google OAuth credentials. Import them from a Google Cloud Console JSON file.
  </Card>

  <Card title="Azure AD" icon="microsoft">
    Your Microsoft Entra (Azure AD) OAuth app. Add a tenant ID for a single-tenant issuer.
  </Card>

  <Card title="Auth0" icon="lock">
    Your Auth0 tenant as the OAuth issuer.
  </Card>
</CardGroup>

A **Custom** option covers any other OAuth 2.0 or OIDC provider that exposes a standard issuer.

## Add a provider

Go to **Identities → Providers** and click **Configure OAuth Provider**.

<Steps>
  <Step title="Name it and pick a provider">
    Enter an **OAuth Client Name** (your own label for this config) and choose the **Provider**: Raily, Google, Azure AD, or Auth0.
  </Step>

  <Step title="Enter the credentials">
    For Raily there's nothing to enter; it's configured for you. For every other provider, add:

    * **Issuer URL**: the provider's OAuth or OIDC issuer.
    * **Client ID** and **Client Secret** from the provider's app.

    Azure also takes a **Tenant ID** (optional; defaults to `common`). For a Google app you can upload the credentials JSON from Google Cloud Console instead of typing the fields.
  </Step>

  <Step title="Discover the configuration">
    Click **Discover Config**. Raily reads the issuer's OpenID configuration and fills in the endpoints, then you can save.
  </Step>

  <Step title="Test the connection">
    On the Providers list, click **Test Connection**. When it passes, the provider shows **Verified**.
  </Step>
</Steps>

## Attach a provider to an endpoint

A provider only takes effect once an endpoint uses it. When you create or edit an endpoint, set **Who can connect** to the provider you added. Your users sign in with it before they can search. Every endpoint needs one; there is no open, no-auth option.

See [AI Endpoints](/concepts/ai-endpoints) for the full endpoint setup.