OptionalclientDriver-specific browser settings (redirect URI, API hostname, region, ...).
OptionalclientPublic OAuth client ID.
Label for the login button (rendered as "Continue with {displayName}").
The server falls back to name when the row has no DisplayName.
OptionaldomainProvider domain (e.g. an Auth0/Okta tenant domain).
ClassFactory resolution key. The browser resolves its MJAuthBase subclass
from this key exactly as the server resolves its BaseAuthProvider subclass,
so a driver ships as a server/browser pair under one name.
OptionaliconFont Awesome class or known brand-logo key for the button's icon chip.
True when this provider is pre-highlighted, and used directly when it is the only one.
OptionalissuerExpected token issuer.
Unique provider name — matches the name the server registered with
AuthProviderFactory, and is what the browser persists when a user picks
a provider from the login picker.
OptionalscopesOAuth scopes to request, already parsed. The server splits the row's delimited Scopes
column once at the trust boundary, so every consumer — the browser drivers hand this
straight to SDK config typed string[] — receives ready-to-use values instead of
re-deriving the delimiter convention.
Ascending sort order within the picker.
The PUBLIC description of one authentication provider, as published by the server's unauthenticated catalog endpoint (
GET /auth/providers) and consumed by the browser before any user is signed in.This type is the trust boundary made explicit. It contains ONLY fields that are safe for an anonymous caller to read — the same values a single-provider SPA already had compiled into its
environment.ts. It intentionally has noID, nocredentialID, and no server-side configuration, so a provider row cannot leak secret material by being published.See
AuthProviderConfig for the richer SERVER-side config used to validate tokens.