IdP selection filter

ProAuth displays the identity providers available to the current tenant and client. Providers marked hidden are omitted from the default selection screen. New integrations use dedicated authorization parameters to choose providers or include selected hidden providers.

Parameter	Behavior
proauth_idp=<idp-id1>,<idp-id2>	Restricts selection to the listed available providers, including hidden providers. A single available provider can be selected directly.
proauth_hidden_idp=<idp-id1>,<idp-id2>	Includes the listed hidden providers alongside the visible providers.

Supply explicit provider IDs with the dedicated parameters. These parameters do not bypass the tenant's or client's allowed-provider configuration. Prefer one filter mode per request; explicit proauth_idp filtering takes precedence if both are supplied.

To hide a provider from the default screen, set its Hidden flag:

Existing clients

The legacy acr_values=idpfilter:<ids> and acr_values=hiddenidpfilter:<ids> forms remain supported for backward compatibility. The empty legacy token hiddenidpfilter: includes all hidden providers otherwise allowed for the tenant and client. When migrating that form, explicitly list the intended IDs in proauth_hidden_idp. Use dedicated parameters for new integrations and reserve acr_values for authentication assurance. If a dedicated parameter and its legacy equivalent are both supplied, their values must match exactly; conflicts return invalid_request.

See authorization parameters and legacy routing for the complete mapping, language selection and migration examples.