---
title: "Configure OpenID Connect - GeCert"
description: "Configure OpenID Connect for GeCert, which requires a GrantID subscription: API connection, frontend, backend and Gecert Connect applications in GrantID Console, and the Oidc section."
canonical: "https://docs.lacunasoftware.com/en-us/articles/gecert/on-premises/configure-oidc"
locale: "en"
product: "GeCert"
last_updated: "2026-10-13"
---

# Configure OpenID Connect - GeCert

[GeCert](https://docs.lacunasoftware.com/en-us/articles/gecert) requires a [GrantID](https://docs.lacunasoftware.com/en-us/articles/grant-id) subscription.

You can either use a SaaS subscription on [grantid.com](https://grantid.com/) or
[run your own instance of GrantID](https://docs.lacunasoftware.com/en-us/articles/grant-id/on-premises).

## Configuring GrantID

Log into the GrantID Console portal and follow the instructions below.

### Create an API Connection

On the **Scopes** tab, click on **New API Connection** to create an API connection for the application, providing:

* **Name**: `gecert`
* **Display name**: `GeCert`
* **User Informations (claims)**: check all

### Frontend Application

On the **Applications** tab, click on **New Application** and provide:

* **Name**: `GeCert`
* **App-id**: `gecert`
* **Type**: select `Implicit flow`.

Click on the **Settings** tab and set:

* Check the `Allow Access tokens via browser?` checkbox (if not already checked)
* Uncheck the following checkboxes (if checked): `Require consent?`, `Front-channel logout session required?` and
  `Back-channel logout session required?`
* **Application URL**: your application's URL. Example: `https://gecert.yourcompany.com`
* **Allowed URLs**:
  * **Redirect**: add 4 redirect URLs based on your application's URL:
    * `<applicationURL>` without a trailing slash.
    * `<applicationURL>/silent-refresh.html`
    * `<applicationURL>/private/profile/refresh`
    * `<applicationURL>/private`
  * **CORS origins**: `<applicationURL>` without a trailing slash.
  * **Post Logout**: `<applicationURL>` without a trailing slash.
* **Allowed Identification Scopes**: check all
* **Allowed API scopes**: check the `GeCert` API scope checkbox

> **Warning**
>
> Don't forget to save your changes by clicking on the button at the end of the page.

### Backend Application

On the **Applications** tab, click again on **New Application** and provide:

* **Name**: `GeCert Backend`
* **App-id**: `gecert-backend`
* **Type**: select `Client credentials`.

Click on the **Settings** tab and set:

* **Allowed API scopes**: check the `Manage subscription's users` checkbox.

> **Warning**
>
> Don't forget to save your changes by clicking on the button at the end of the page.

After saving, go back to the **Basic Details** tab and, on the **App Secret** section, click on **Generate** and then on
**Generate Secret**. This is the value of the `AppSecret` setting (copy it and keep it for later use).

### Gecert Connect application

Create one more application for [Gecert Connect](https://docs.lacunasoftware.com/en-us/articles/gecert/gecert-connect), with an App-id such as `gecert-connect`, using the authorization
code flow with PKCE, with offline access allowed, the `GeCert` API scope and a redirect URI. Its values go in the server's
`GecertConnect` section: see [Configure Gecert Connect on the server](https://docs.lacunasoftware.com/en-us/articles/gecert/on-premises/configure-gecert-connect).

## Configuring GeCert to use GrantID

Once you have followed the steps above to configure GrantID, fill the section **Oidc** of the configuration file:

* **Authority**: the OIDC authority (e.g. *https://login.id.patorum.com*)
* **ApiEndpoint**: the API endpoint of the OIDC server (e.g. *https://api.id.patorum.com*)
* **ApiName**: `gecert`
* **ClientAppId**: `gecert`
* **AppId**: `gecert-backend`
* **AppSecret**: the generated secret of the backend application

Example (*.ini* or *.conf* configuration file):

```ini
[Oidc]
Authority=https://login.id.patorum.com
ApiEndpoint=https://api.id.patorum.com
ApiName=gecert
ClientAppId=gecert
AppId=gecert-backend
AppSecret=YOUR_BACKEND_APP_SECRET
```

Example (environment variables):

```bash
Oidc__Authority=https://login.id.patorum.com
Oidc__ApiEndpoint=https://api.id.patorum.com
Oidc__ApiName=gecert
Oidc__ClientAppId=gecert
Oidc__AppId=gecert-backend
Oidc__AppSecret=YOUR_BACKEND_APP_SECRET
```

## First user

Full **Sys Admin** privileges are given to the first user that signs in to the application. If another user needs those privileges and
nobody can grant them through the application, grant them through the database. Start by finding the user's `Id`:

```sql
SELECT "Id", "Name", "EmailAddress"
FROM "Agents"
WHERE "Subject" IS NOT NULL
```

Then grant the *Owner* Sys Admin role (copy the user's `Id` into the query below). In GeCert, the `RootRoleFlags` value for the *Owner*
role is **2**: 

```sql
UPDATE "Agents"
SET "RootRoleFlags" = 2
WHERE "Id" = 'YOUR-USER-ID'
```

## See also

* [GrantID](https://docs.lacunasoftware.com/en-us/articles/grant-id)
* [Configure Gecert Connect on the server](https://docs.lacunasoftware.com/en-us/articles/gecert/on-premises/configure-gecert-connect)