Enterprise-tier organizations can use their OAuth provider to manage API access using externally generated tokens. After configuring an OAuth provider, create account mappings to link AI Hub accounts to external identities. When an API request is made with an externally managed token, AI Hub validates the token and extracts the subject claim to identify the account. The request is then authorized based on either:
The token’s scope claim, if present and valid, which defines role-based permissions for the token.
Or, if no valid scope is provided, the mapped account’s assigned roles and associated permissions.
Admins can add and manage OAuth account mappings.
Adding account mappings is similar for user and service accounts. Each mapping connects an AI Hub account to a unique external account identifier in your OAuth provider. Each account can have one mapping per configured OAuth provider.
Before adding account mappings, ensure you have:
Configured an OAuth provider for your organization.
Taken note of external account identifiers for each user or service account you want to map. This identifier must match the value passed in the issued token’s subject claim.
AI Hub looks for the subject in the sub claim, unless configured otherwise.
In the header, click the initials icon and select Settings. Select the organization name tab.
For user accounts, on the Members tab, select the user account to map. For service accounts, on the Service accounts tab, select the service account to map.
In the OAuth account mappings section, click Add mapping.
Add a display name to identify the mapping.
Select an OAuth provider configuration.
Enter the external account identifier.
Click Add mapping.
You can update the display name of an account mapping.
In the header, click the initials icon and select Settings. Select the organization name tab.
Select the Members or Service accounts tab.
Select the user or service account with the mapping to update.
In the OAuth account mappings section, locate the mapping to update. Click the overflow icon 
, then select Edit mapping.
Make any changes, then click Update mapping.
Deleting an account mapping immediately revokes the ability to use OAuth tokens associated with that external account identifier. Active tokens are invalidated on their next use.
In the header, click the initials icon and select Settings. Select the organization name tab.
Select the Members or Service accounts tab.
Select the user or service account with the mapping to delete.
In the OAuth account mappings section, locate the mapping to delete. Click the overflow icon , then select Delete mapping.
Enter the confirmation text, then click Delete to confirm.
