OIDC
Configure an OIDC provider where browser sign-in is needed. NSD supports console identity configuration and OIDC identities for protected public L7 applications; the provider and matching Grant remain explicit.
See protected public ingress
Product integrations
Connect identity and events without adding another workflow.
NSD provides configured OIDC, scoped API Tokens, HMAC-signed Webhooks and a searchable Activity log. Optional email and external audit export remain explicit deployment settings, not assumed services.
OIDCAPI TokensSigned WebhooksActivity log
Integration mapCurrent Space
IdentityOIDC providerconfigured for its purpose
ControlNSDsign-in · public L7 identity
AutomationScoped API Tokenplaintext shown once
InterfaceNSD APIauthority follows token scope
EventsActivity logactor · action · outcome
DeliverySigned WebhookHTTPS receiver
Four concrete surfaces
Integrate from the control point that owns the decision.
Each surface has a distinct purpose. None silently imports a directory, changes a Grant or broadens resource access.
API Tokens
Create a named token for scripts or backend integrations, choose its available scope and expiry, copy the plaintext once, then inspect or revoke it from NSD.
Plan an automation pathWebhooks
Send selected lifecycle and audit actions to an HTTPS receiver. NSD signs deliveries with HMAC, supports action-prefix filters and records recent delivery attempts.
Review webhook boundariesActivity log
Search administrative and system events by actor, action, resource and outcome. Filters and event details help an operator understand what changed before forwarding anything elsewhere.
Explore security operationsTrust boundariesConfiguration required
OIDCProvider + client configurationauthentication does not replace authorization
API TokenNamed scope + optional expiryplaintext is shown only when created
WebhookHTTPS URL + write-only secretreceiver verifies signature and delivery identity
The current Organization and Network Space remains the resource boundary.
Configuration is part of the contract
Make every external dependency visible.
Identity providers, receivers and credentials are configured deliberately. A successful authentication or event delivery does not create broader access than the current Space and its rules allow.
Authentication
OIDC proves the configured external identity. The applicable system rule or explicit Grant still decides access.
Credentials
Use the narrowest available API Token scope, store its one-time plaintext outside NSD and revoke it when its owner or purpose changes.
Deliveries
Verify webhook signatures, reject stale messages and use delivery IDs for deduplication in the receiving system.
Evidence
Start with the Activity log, then add configured outbound channels only when the operating model needs them.
Optional deployment channels
Available only when your deployment enables them.
These are deployment choices, not blanket promises attached to every Space or plan.
Outbound email
A configured mail transport can deliver supported account, invitation or alert messages. If mail is not configured, those email channels are unavailable.
External audit export
A self-operated NSD deployment can send Activity log events to a configured external destination. Export must be enabled and operated deliberately.
Console visibility
The Activity log and webhook delivery history remain the first places to inspect control changes and outbound delivery results.
Integrate one boundary at a time
Start with the identity or event path you can operate reliably.
Open NSD to review the integration surfaces available in your deployment, or use the product documentation to plan configuration and secret custody.