diff --git a/proto/gen/api/v1/auth_service.pb.gw.go b/proto/gen/api/v1/auth_service.pb.gw.go
index ed188df..fcc7f1b 100644
--- a/proto/gen/api/v1/auth_service.pb.gw.go
+++ b/proto/gen/api/v1/auth_service.pb.gw.go
@@ -143,6 +143,7 @@ func local_request_AuthService_SignOut_0(ctx context.Context, marshaler runtime.
 // UnaryRPC     :call AuthServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
 // Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterAuthServiceHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
 func RegisterAuthServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server AuthServiceServer) error {
 
 	mux.Handle("POST", pattern_AuthService_GetAuthStatus_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
@@ -283,7 +284,7 @@ func RegisterAuthServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn
 // to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "AuthServiceClient".
 // Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "AuthServiceClient"
 // doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
-// "AuthServiceClient" to call the correct interceptors.
+// "AuthServiceClient" to call the correct interceptors. This client ignores the HTTP middlewares.
 func RegisterAuthServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client AuthServiceClient) error {
 
 	mux.Handle("POST", pattern_AuthService_GetAuthStatus_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
diff --git a/proto/gen/api/v1/auth_service_grpc.pb.go b/proto/gen/api/v1/auth_service_grpc.pb.go
index 0ad77bc..d8cc830 100644
--- a/proto/gen/api/v1/auth_service_grpc.pb.go
+++ b/proto/gen/api/v1/auth_service_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: api/v1/auth_service.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	AuthService_GetAuthStatus_FullMethodName = "/slash.api.v1.AuthService/GetAuthStatus"
@@ -85,7 +85,7 @@ func (c *authServiceClient) SignOut(ctx context.Context, in *SignOutRequest, opt
 
 // AuthServiceServer is the server API for AuthService service.
 // All implementations must embed UnimplementedAuthServiceServer
-// for forward compatibility
+// for forward compatibility.
 type AuthServiceServer interface {
 	GetAuthStatus(context.Context, *GetAuthStatusRequest) (*GetAuthStatusResponse, error)
 	SignIn(context.Context, *SignInRequest) (*SignInResponse, error)
@@ -94,9 +94,12 @@ type AuthServiceServer interface {
 	mustEmbedUnimplementedAuthServiceServer()
 }
 
-// UnimplementedAuthServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedAuthServiceServer struct {
-}
+// UnimplementedAuthServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedAuthServiceServer struct{}
 
 func (UnimplementedAuthServiceServer) GetAuthStatus(context.Context, *GetAuthStatusRequest) (*GetAuthStatusResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetAuthStatus not implemented")
@@ -111,6 +114,7 @@ func (UnimplementedAuthServiceServer) SignOut(context.Context, *SignOutRequest)
 	return nil, status.Errorf(codes.Unimplemented, "method SignOut not implemented")
 }
 func (UnimplementedAuthServiceServer) mustEmbedUnimplementedAuthServiceServer() {}
+func (UnimplementedAuthServiceServer) testEmbeddedByValue()                     {}
 
 // UnsafeAuthServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to AuthServiceServer will
@@ -120,6 +124,13 @@ type UnsafeAuthServiceServer interface {
 }
 
 func RegisterAuthServiceServer(s grpc.ServiceRegistrar, srv AuthServiceServer) {
+	// If the following call pancis, it indicates UnimplementedAuthServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&AuthService_ServiceDesc, srv)
 }
 
diff --git a/proto/gen/api/v1/collection_service.pb.gw.go b/proto/gen/api/v1/collection_service.pb.gw.go
index 03b9319..3c4e604 100644
--- a/proto/gen/api/v1/collection_service.pb.gw.go
+++ b/proto/gen/api/v1/collection_service.pb.gw.go
@@ -261,6 +261,7 @@ func local_request_CollectionService_DeleteCollection_0(ctx context.Context, mar
 // UnaryRPC     :call CollectionServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
 // Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterCollectionServiceHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
 func RegisterCollectionServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server CollectionServiceServer) error {
 
 	mux.Handle("GET", pattern_CollectionService_ListCollections_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
@@ -426,7 +427,7 @@ func RegisterCollectionServiceHandler(ctx context.Context, mux *runtime.ServeMux
 // to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "CollectionServiceClient".
 // Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "CollectionServiceClient"
 // doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
-// "CollectionServiceClient" to call the correct interceptors.
+// "CollectionServiceClient" to call the correct interceptors. This client ignores the HTTP middlewares.
 func RegisterCollectionServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client CollectionServiceClient) error {
 
 	mux.Handle("GET", pattern_CollectionService_ListCollections_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
diff --git a/proto/gen/api/v1/collection_service_grpc.pb.go b/proto/gen/api/v1/collection_service_grpc.pb.go
index 56c6b7f..cda707b 100644
--- a/proto/gen/api/v1/collection_service_grpc.pb.go
+++ b/proto/gen/api/v1/collection_service_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: api/v1/collection_service.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	CollectionService_ListCollections_FullMethodName     = "/slash.api.v1.CollectionService/ListCollections"
@@ -115,7 +115,7 @@ func (c *collectionServiceClient) DeleteCollection(ctx context.Context, in *Dele
 
 // CollectionServiceServer is the server API for CollectionService service.
 // All implementations must embed UnimplementedCollectionServiceServer
-// for forward compatibility
+// for forward compatibility.
 type CollectionServiceServer interface {
 	// ListCollections returns a list of collections.
 	ListCollections(context.Context, *ListCollectionsRequest) (*ListCollectionsResponse, error)
@@ -132,9 +132,12 @@ type CollectionServiceServer interface {
 	mustEmbedUnimplementedCollectionServiceServer()
 }
 
-// UnimplementedCollectionServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedCollectionServiceServer struct {
-}
+// UnimplementedCollectionServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedCollectionServiceServer struct{}
 
 func (UnimplementedCollectionServiceServer) ListCollections(context.Context, *ListCollectionsRequest) (*ListCollectionsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListCollections not implemented")
@@ -155,6 +158,7 @@ func (UnimplementedCollectionServiceServer) DeleteCollection(context.Context, *D
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteCollection not implemented")
 }
 func (UnimplementedCollectionServiceServer) mustEmbedUnimplementedCollectionServiceServer() {}
+func (UnimplementedCollectionServiceServer) testEmbeddedByValue()                           {}
 
 // UnsafeCollectionServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to CollectionServiceServer will
@@ -164,6 +168,13 @@ type UnsafeCollectionServiceServer interface {
 }
 
 func RegisterCollectionServiceServer(s grpc.ServiceRegistrar, srv CollectionServiceServer) {
+	// If the following call pancis, it indicates UnimplementedCollectionServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&CollectionService_ServiceDesc, srv)
 }
 
diff --git a/proto/gen/api/v1/shortcut_service.pb.gw.go b/proto/gen/api/v1/shortcut_service.pb.gw.go
index 885d322..db85530 100644
--- a/proto/gen/api/v1/shortcut_service.pb.gw.go
+++ b/proto/gen/api/v1/shortcut_service.pb.gw.go
@@ -313,6 +313,7 @@ func local_request_ShortcutService_GetShortcutAnalytics_0(ctx context.Context, m
 // UnaryRPC     :call ShortcutServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
 // Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterShortcutServiceHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
 func RegisterShortcutServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server ShortcutServiceServer) error {
 
 	mux.Handle("GET", pattern_ShortcutService_ListShortcuts_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
@@ -503,7 +504,7 @@ func RegisterShortcutServiceHandler(ctx context.Context, mux *runtime.ServeMux,
 // to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "ShortcutServiceClient".
 // Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "ShortcutServiceClient"
 // doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
-// "ShortcutServiceClient" to call the correct interceptors.
+// "ShortcutServiceClient" to call the correct interceptors. This client ignores the HTTP middlewares.
 func RegisterShortcutServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client ShortcutServiceClient) error {
 
 	mux.Handle("GET", pattern_ShortcutService_ListShortcuts_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
diff --git a/proto/gen/api/v1/shortcut_service_grpc.pb.go b/proto/gen/api/v1/shortcut_service_grpc.pb.go
index c461790..7da2f17 100644
--- a/proto/gen/api/v1/shortcut_service_grpc.pb.go
+++ b/proto/gen/api/v1/shortcut_service_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: api/v1/shortcut_service.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	ShortcutService_ListShortcuts_FullMethodName        = "/slash.api.v1.ShortcutService/ListShortcuts"
@@ -128,7 +128,7 @@ func (c *shortcutServiceClient) GetShortcutAnalytics(ctx context.Context, in *Ge
 
 // ShortcutServiceServer is the server API for ShortcutService service.
 // All implementations must embed UnimplementedShortcutServiceServer
-// for forward compatibility
+// for forward compatibility.
 type ShortcutServiceServer interface {
 	// ListShortcuts returns a list of shortcuts.
 	ListShortcuts(context.Context, *ListShortcutsRequest) (*ListShortcutsResponse, error)
@@ -147,9 +147,12 @@ type ShortcutServiceServer interface {
 	mustEmbedUnimplementedShortcutServiceServer()
 }
 
-// UnimplementedShortcutServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedShortcutServiceServer struct {
-}
+// UnimplementedShortcutServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedShortcutServiceServer struct{}
 
 func (UnimplementedShortcutServiceServer) ListShortcuts(context.Context, *ListShortcutsRequest) (*ListShortcutsResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListShortcuts not implemented")
@@ -173,6 +176,7 @@ func (UnimplementedShortcutServiceServer) GetShortcutAnalytics(context.Context,
 	return nil, status.Errorf(codes.Unimplemented, "method GetShortcutAnalytics not implemented")
 }
 func (UnimplementedShortcutServiceServer) mustEmbedUnimplementedShortcutServiceServer() {}
+func (UnimplementedShortcutServiceServer) testEmbeddedByValue()                         {}
 
 // UnsafeShortcutServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to ShortcutServiceServer will
@@ -182,6 +186,13 @@ type UnsafeShortcutServiceServer interface {
 }
 
 func RegisterShortcutServiceServer(s grpc.ServiceRegistrar, srv ShortcutServiceServer) {
+	// If the following call pancis, it indicates UnimplementedShortcutServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&ShortcutService_ServiceDesc, srv)
 }
 
diff --git a/proto/gen/api/v1/subscription_service.pb.gw.go b/proto/gen/api/v1/subscription_service.pb.gw.go
index d47ddcd..19a2a2a 100644
--- a/proto/gen/api/v1/subscription_service.pb.gw.go
+++ b/proto/gen/api/v1/subscription_service.pb.gw.go
@@ -79,6 +79,7 @@ func local_request_SubscriptionService_UpdateSubscription_0(ctx context.Context,
 // UnaryRPC     :call SubscriptionServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
 // Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterSubscriptionServiceHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
 func RegisterSubscriptionServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server SubscriptionServiceServer) error {
 
 	mux.Handle("GET", pattern_SubscriptionService_GetSubscription_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
@@ -169,7 +170,7 @@ func RegisterSubscriptionServiceHandler(ctx context.Context, mux *runtime.ServeM
 // to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "SubscriptionServiceClient".
 // Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "SubscriptionServiceClient"
 // doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
-// "SubscriptionServiceClient" to call the correct interceptors.
+// "SubscriptionServiceClient" to call the correct interceptors. This client ignores the HTTP middlewares.
 func RegisterSubscriptionServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client SubscriptionServiceClient) error {
 
 	mux.Handle("GET", pattern_SubscriptionService_GetSubscription_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
diff --git a/proto/gen/api/v1/subscription_service_grpc.pb.go b/proto/gen/api/v1/subscription_service_grpc.pb.go
index 9927e17..3f68c51 100644
--- a/proto/gen/api/v1/subscription_service_grpc.pb.go
+++ b/proto/gen/api/v1/subscription_service_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: api/v1/subscription_service.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	SubscriptionService_GetSubscription_FullMethodName    = "/slash.api.v1.SubscriptionService/GetSubscription"
@@ -61,16 +61,19 @@ func (c *subscriptionServiceClient) UpdateSubscription(ctx context.Context, in *
 
 // SubscriptionServiceServer is the server API for SubscriptionService service.
 // All implementations must embed UnimplementedSubscriptionServiceServer
-// for forward compatibility
+// for forward compatibility.
 type SubscriptionServiceServer interface {
 	GetSubscription(context.Context, *GetSubscriptionRequest) (*GetSubscriptionResponse, error)
 	UpdateSubscription(context.Context, *UpdateSubscriptionRequest) (*UpdateSubscriptionResponse, error)
 	mustEmbedUnimplementedSubscriptionServiceServer()
 }
 
-// UnimplementedSubscriptionServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedSubscriptionServiceServer struct {
-}
+// UnimplementedSubscriptionServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedSubscriptionServiceServer struct{}
 
 func (UnimplementedSubscriptionServiceServer) GetSubscription(context.Context, *GetSubscriptionRequest) (*GetSubscriptionResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetSubscription not implemented")
@@ -79,6 +82,7 @@ func (UnimplementedSubscriptionServiceServer) UpdateSubscription(context.Context
 	return nil, status.Errorf(codes.Unimplemented, "method UpdateSubscription not implemented")
 }
 func (UnimplementedSubscriptionServiceServer) mustEmbedUnimplementedSubscriptionServiceServer() {}
+func (UnimplementedSubscriptionServiceServer) testEmbeddedByValue()                             {}
 
 // UnsafeSubscriptionServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to SubscriptionServiceServer will
@@ -88,6 +92,13 @@ type UnsafeSubscriptionServiceServer interface {
 }
 
 func RegisterSubscriptionServiceServer(s grpc.ServiceRegistrar, srv SubscriptionServiceServer) {
+	// If the following call pancis, it indicates UnimplementedSubscriptionServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&SubscriptionService_ServiceDesc, srv)
 }
 
diff --git a/proto/gen/api/v1/user_service.pb.gw.go b/proto/gen/api/v1/user_service.pb.gw.go
index 2d93dcb..7c99c39 100644
--- a/proto/gen/api/v1/user_service.pb.gw.go
+++ b/proto/gen/api/v1/user_service.pb.gw.go
@@ -467,6 +467,7 @@ func local_request_UserService_DeleteUserAccessToken_0(ctx context.Context, mars
 // UnaryRPC     :call UserServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
 // Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterUserServiceHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
 func RegisterUserServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server UserServiceServer) error {
 
 	mux.Handle("GET", pattern_UserService_ListUsers_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
@@ -707,7 +708,7 @@ func RegisterUserServiceHandler(ctx context.Context, mux *runtime.ServeMux, conn
 // to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "UserServiceClient".
 // Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "UserServiceClient"
 // doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
-// "UserServiceClient" to call the correct interceptors.
+// "UserServiceClient" to call the correct interceptors. This client ignores the HTTP middlewares.
 func RegisterUserServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client UserServiceClient) error {
 
 	mux.Handle("GET", pattern_UserService_ListUsers_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
diff --git a/proto/gen/api/v1/user_service_grpc.pb.go b/proto/gen/api/v1/user_service_grpc.pb.go
index 6bc7f40..1be5c26 100644
--- a/proto/gen/api/v1/user_service_grpc.pb.go
+++ b/proto/gen/api/v1/user_service_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: api/v1/user_service.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	UserService_ListUsers_FullMethodName             = "/slash.api.v1.UserService/ListUsers"
@@ -140,7 +140,7 @@ func (c *userServiceClient) DeleteUserAccessToken(ctx context.Context, in *Delet
 
 // UserServiceServer is the server API for UserService service.
 // All implementations must embed UnimplementedUserServiceServer
-// for forward compatibility
+// for forward compatibility.
 type UserServiceServer interface {
 	// ListUsers returns a list of users.
 	ListUsers(context.Context, *ListUsersRequest) (*ListUsersResponse, error)
@@ -160,9 +160,12 @@ type UserServiceServer interface {
 	mustEmbedUnimplementedUserServiceServer()
 }
 
-// UnimplementedUserServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedUserServiceServer struct {
-}
+// UnimplementedUserServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedUserServiceServer struct{}
 
 func (UnimplementedUserServiceServer) ListUsers(context.Context, *ListUsersRequest) (*ListUsersResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method ListUsers not implemented")
@@ -189,6 +192,7 @@ func (UnimplementedUserServiceServer) DeleteUserAccessToken(context.Context, *De
 	return nil, status.Errorf(codes.Unimplemented, "method DeleteUserAccessToken not implemented")
 }
 func (UnimplementedUserServiceServer) mustEmbedUnimplementedUserServiceServer() {}
+func (UnimplementedUserServiceServer) testEmbeddedByValue()                     {}
 
 // UnsafeUserServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to UserServiceServer will
@@ -198,6 +202,13 @@ type UnsafeUserServiceServer interface {
 }
 
 func RegisterUserServiceServer(s grpc.ServiceRegistrar, srv UserServiceServer) {
+	// If the following call pancis, it indicates UnimplementedUserServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&UserService_ServiceDesc, srv)
 }
 
diff --git a/proto/gen/api/v1/user_setting_service.pb.gw.go b/proto/gen/api/v1/user_setting_service.pb.gw.go
index afa8eb7..77a0d9f 100644
--- a/proto/gen/api/v1/user_setting_service.pb.gw.go
+++ b/proto/gen/api/v1/user_setting_service.pb.gw.go
@@ -187,6 +187,7 @@ func local_request_UserSettingService_UpdateUserSetting_0(ctx context.Context, m
 // UnaryRPC     :call UserSettingServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
 // Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterUserSettingServiceHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
 func RegisterUserSettingServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server UserSettingServiceServer) error {
 
 	mux.Handle("GET", pattern_UserSettingService_GetUserSetting_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
@@ -277,7 +278,7 @@ func RegisterUserSettingServiceHandler(ctx context.Context, mux *runtime.ServeMu
 // to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "UserSettingServiceClient".
 // Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "UserSettingServiceClient"
 // doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
-// "UserSettingServiceClient" to call the correct interceptors.
+// "UserSettingServiceClient" to call the correct interceptors. This client ignores the HTTP middlewares.
 func RegisterUserSettingServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client UserSettingServiceClient) error {
 
 	mux.Handle("GET", pattern_UserSettingService_GetUserSetting_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
diff --git a/proto/gen/api/v1/user_setting_service_grpc.pb.go b/proto/gen/api/v1/user_setting_service_grpc.pb.go
index 8d89e95..90fee7a 100644
--- a/proto/gen/api/v1/user_setting_service_grpc.pb.go
+++ b/proto/gen/api/v1/user_setting_service_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: api/v1/user_setting_service.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	UserSettingService_GetUserSetting_FullMethodName    = "/slash.api.v1.UserSettingService/GetUserSetting"
@@ -63,7 +63,7 @@ func (c *userSettingServiceClient) UpdateUserSetting(ctx context.Context, in *Up
 
 // UserSettingServiceServer is the server API for UserSettingService service.
 // All implementations must embed UnimplementedUserSettingServiceServer
-// for forward compatibility
+// for forward compatibility.
 type UserSettingServiceServer interface {
 	// GetUserSetting returns the user setting.
 	GetUserSetting(context.Context, *GetUserSettingRequest) (*GetUserSettingResponse, error)
@@ -72,9 +72,12 @@ type UserSettingServiceServer interface {
 	mustEmbedUnimplementedUserSettingServiceServer()
 }
 
-// UnimplementedUserSettingServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedUserSettingServiceServer struct {
-}
+// UnimplementedUserSettingServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedUserSettingServiceServer struct{}
 
 func (UnimplementedUserSettingServiceServer) GetUserSetting(context.Context, *GetUserSettingRequest) (*GetUserSettingResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetUserSetting not implemented")
@@ -83,6 +86,7 @@ func (UnimplementedUserSettingServiceServer) UpdateUserSetting(context.Context,
 	return nil, status.Errorf(codes.Unimplemented, "method UpdateUserSetting not implemented")
 }
 func (UnimplementedUserSettingServiceServer) mustEmbedUnimplementedUserSettingServiceServer() {}
+func (UnimplementedUserSettingServiceServer) testEmbeddedByValue()                            {}
 
 // UnsafeUserSettingServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to UserSettingServiceServer will
@@ -92,6 +96,13 @@ type UnsafeUserSettingServiceServer interface {
 }
 
 func RegisterUserSettingServiceServer(s grpc.ServiceRegistrar, srv UserSettingServiceServer) {
+	// If the following call pancis, it indicates UnimplementedUserSettingServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&UserSettingService_ServiceDesc, srv)
 }
 
diff --git a/proto/gen/api/v1/workspace_service.pb.gw.go b/proto/gen/api/v1/workspace_service.pb.gw.go
index 8e5a364..4543024 100644
--- a/proto/gen/api/v1/workspace_service.pb.gw.go
+++ b/proto/gen/api/v1/workspace_service.pb.gw.go
@@ -137,6 +137,7 @@ func local_request_WorkspaceService_UpdateWorkspaceSetting_0(ctx context.Context
 // UnaryRPC     :call WorkspaceServiceServer directly.
 // StreamingRPC :currently unsupported pending https://github.com/grpc/grpc-go/issues/906.
 // Note that using this registration option will cause many gRPC library features to stop working. Consider using RegisterWorkspaceServiceHandlerFromEndpoint instead.
+// GRPC interceptors will not work for this type of registration. To use interceptors, you must use the "runtime.WithMiddlewares" option in the "runtime.NewServeMux" call.
 func RegisterWorkspaceServiceHandlerServer(ctx context.Context, mux *runtime.ServeMux, server WorkspaceServiceServer) error {
 
 	mux.Handle("GET", pattern_WorkspaceService_GetWorkspaceProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
@@ -252,7 +253,7 @@ func RegisterWorkspaceServiceHandler(ctx context.Context, mux *runtime.ServeMux,
 // to "mux". The handlers forward requests to the grpc endpoint over the given implementation of "WorkspaceServiceClient".
 // Note: the gRPC framework executes interceptors within the gRPC handler. If the passed in "WorkspaceServiceClient"
 // doesn't go through the normal gRPC flow (creating a gRPC client etc.) then it will be up to the passed in
-// "WorkspaceServiceClient" to call the correct interceptors.
+// "WorkspaceServiceClient" to call the correct interceptors. This client ignores the HTTP middlewares.
 func RegisterWorkspaceServiceHandlerClient(ctx context.Context, mux *runtime.ServeMux, client WorkspaceServiceClient) error {
 
 	mux.Handle("GET", pattern_WorkspaceService_GetWorkspaceProfile_0, func(w http.ResponseWriter, req *http.Request, pathParams map[string]string) {
diff --git a/proto/gen/api/v1/workspace_service_grpc.pb.go b/proto/gen/api/v1/workspace_service_grpc.pb.go
index ce95d79..3de4ca1 100644
--- a/proto/gen/api/v1/workspace_service_grpc.pb.go
+++ b/proto/gen/api/v1/workspace_service_grpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
-// - protoc-gen-go-grpc v1.4.0
+// - protoc-gen-go-grpc v1.5.1
 // - protoc             (unknown)
 // source: api/v1/workspace_service.proto
 
@@ -15,8 +15,8 @@ import (
 
 // This is a compile-time assertion to ensure that this generated file
 // is compatible with the grpc package it is being compiled against.
-// Requires gRPC-Go v1.62.0 or later.
-const _ = grpc.SupportPackageIsVersion8
+// Requires gRPC-Go v1.64.0 or later.
+const _ = grpc.SupportPackageIsVersion9
 
 const (
 	WorkspaceService_GetWorkspaceProfile_FullMethodName    = "/slash.api.v1.WorkspaceService/GetWorkspaceProfile"
@@ -73,7 +73,7 @@ func (c *workspaceServiceClient) UpdateWorkspaceSetting(ctx context.Context, in
 
 // WorkspaceServiceServer is the server API for WorkspaceService service.
 // All implementations must embed UnimplementedWorkspaceServiceServer
-// for forward compatibility
+// for forward compatibility.
 type WorkspaceServiceServer interface {
 	GetWorkspaceProfile(context.Context, *GetWorkspaceProfileRequest) (*GetWorkspaceProfileResponse, error)
 	GetWorkspaceSetting(context.Context, *GetWorkspaceSettingRequest) (*GetWorkspaceSettingResponse, error)
@@ -81,9 +81,12 @@ type WorkspaceServiceServer interface {
 	mustEmbedUnimplementedWorkspaceServiceServer()
 }
 
-// UnimplementedWorkspaceServiceServer must be embedded to have forward compatible implementations.
-type UnimplementedWorkspaceServiceServer struct {
-}
+// UnimplementedWorkspaceServiceServer must be embedded to have
+// forward compatible implementations.
+//
+// NOTE: this should be embedded by value instead of pointer to avoid a nil
+// pointer dereference when methods are called.
+type UnimplementedWorkspaceServiceServer struct{}
 
 func (UnimplementedWorkspaceServiceServer) GetWorkspaceProfile(context.Context, *GetWorkspaceProfileRequest) (*GetWorkspaceProfileResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method GetWorkspaceProfile not implemented")
@@ -95,6 +98,7 @@ func (UnimplementedWorkspaceServiceServer) UpdateWorkspaceSetting(context.Contex
 	return nil, status.Errorf(codes.Unimplemented, "method UpdateWorkspaceSetting not implemented")
 }
 func (UnimplementedWorkspaceServiceServer) mustEmbedUnimplementedWorkspaceServiceServer() {}
+func (UnimplementedWorkspaceServiceServer) testEmbeddedByValue()                          {}
 
 // UnsafeWorkspaceServiceServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to WorkspaceServiceServer will
@@ -104,6 +108,13 @@ type UnsafeWorkspaceServiceServer interface {
 }
 
 func RegisterWorkspaceServiceServer(s grpc.ServiceRegistrar, srv WorkspaceServiceServer) {
+	// If the following call pancis, it indicates UnimplementedWorkspaceServiceServer was
+	// embedded by pointer and is nil.  This will cause panics if an
+	// unimplemented method is ever invoked, so we test this at initialization
+	// time to prevent it from happening at runtime later due to I/O.
+	if t, ok := srv.(interface{ testEmbeddedByValue() }); ok {
+		t.testEmbeddedByValue()
+	}
 	s.RegisterService(&WorkspaceService_ServiceDesc, srv)
 }
 
diff --git a/proto/gen/store/README.md b/proto/gen/store/README.md
index 92b8926..a7fa432 100644
--- a/proto/gen/store/README.md
+++ b/proto/gen/store/README.md
@@ -14,6 +14,14 @@
 - [store/collection.proto](#store_collection-proto)
     - [Collection](#slash-store-Collection)
   
+- [store/idp.proto](#store_idp-proto)
+    - [IdentityProvider](#slash-store-IdentityProvider)
+    - [IdentityProviderConfig](#slash-store-IdentityProviderConfig)
+    - [IdentityProviderConfig.FieldMapping](#slash-store-IdentityProviderConfig-FieldMapping)
+    - [IdentityProviderConfig.OAuth2Config](#slash-store-IdentityProviderConfig-OAuth2Config)
+  
+    - [IdentityProvider.Type](#slash-store-IdentityProvider-Type)
+  
 - [store/shortcut.proto](#store_shortcut-proto)
     - [OpenGraphMetadata](#slash-store-OpenGraphMetadata)
     - [Shortcut](#slash-store-Shortcut)
@@ -29,6 +37,7 @@
 - [store/workspace_setting.proto](#store_workspace_setting-proto)
     - [WorkspaceSetting](#slash-store-WorkspaceSetting)
     - [WorkspaceSetting.GeneralSetting](#slash-store-WorkspaceSetting-GeneralSetting)
+    - [WorkspaceSetting.IdentityProviderSetting](#slash-store-WorkspaceSetting-IdentityProviderSetting)
     - [WorkspaceSetting.ShortcutRelatedSetting](#slash-store-WorkspaceSetting-ShortcutRelatedSetting)
   
     - [WorkspaceSettingKey](#slash-store-WorkspaceSettingKey)
@@ -168,6 +177,103 @@
 
 
 
+<a name="store_idp-proto"></a>
+<p align="right"><a href="#top">Top</a></p>
+
+## store/idp.proto
+
+
+
+<a name="slash-store-IdentityProvider"></a>
+
+### IdentityProvider
+
+
+
+| Field | Type | Label | Description |
+| ----- | ---- | ----- | ----------- |
+| name | [string](#string) |  |  |
+| type | [IdentityProvider.Type](#slash-store-IdentityProvider-Type) |  |  |
+| config | [IdentityProviderConfig](#slash-store-IdentityProviderConfig) |  |  |
+
+
+
+
+
+
+<a name="slash-store-IdentityProviderConfig"></a>
+
+### IdentityProviderConfig
+
+
+
+| Field | Type | Label | Description |
+| ----- | ---- | ----- | ----------- |
+| oauth2_config | [IdentityProviderConfig.OAuth2Config](#slash-store-IdentityProviderConfig-OAuth2Config) |  |  |
+
+
+
+
+
+
+<a name="slash-store-IdentityProviderConfig-FieldMapping"></a>
+
+### IdentityProviderConfig.FieldMapping
+
+
+
+| Field | Type | Label | Description |
+| ----- | ---- | ----- | ----------- |
+| email | [string](#string) |  |  |
+| display_name | [string](#string) |  |  |
+
+
+
+
+
+
+<a name="slash-store-IdentityProviderConfig-OAuth2Config"></a>
+
+### IdentityProviderConfig.OAuth2Config
+
+
+
+| Field | Type | Label | Description |
+| ----- | ---- | ----- | ----------- |
+| client_id | [string](#string) |  |  |
+| client_secret | [string](#string) |  |  |
+| auth_url | [string](#string) |  |  |
+| token_url | [string](#string) |  |  |
+| user_info_url | [string](#string) |  |  |
+| scopes | [string](#string) | repeated |  |
+| field_mapping | [IdentityProviderConfig.FieldMapping](#slash-store-IdentityProviderConfig-FieldMapping) |  |  |
+
+
+
+
+
+ 
+
+
+<a name="slash-store-IdentityProvider-Type"></a>
+
+### IdentityProvider.Type
+
+
+| Name | Number | Description |
+| ---- | ------ | ----------- |
+| TYPE_UNSPECIFIED | 0 |  |
+| OAUTH2 | 1 |  |
+
+
+ 
+
+ 
+
+ 
+
+
+
 <a name="store_shortcut-proto"></a>
 <p align="right"><a href="#top">Top</a></p>
 
@@ -340,6 +446,7 @@
 | raw | [string](#string) |  |  |
 | general | [WorkspaceSetting.GeneralSetting](#slash-store-WorkspaceSetting-GeneralSetting) |  |  |
 | shortcut_related | [WorkspaceSetting.ShortcutRelatedSetting](#slash-store-WorkspaceSetting-ShortcutRelatedSetting) |  |  |
+| identity_provider | [WorkspaceSetting.IdentityProviderSetting](#slash-store-WorkspaceSetting-IdentityProviderSetting) |  |  |
 
 
 
@@ -364,6 +471,21 @@
 
 
 
+<a name="slash-store-WorkspaceSetting-IdentityProviderSetting"></a>
+
+### WorkspaceSetting.IdentityProviderSetting
+
+
+
+| Field | Type | Label | Description |
+| ----- | ---- | ----- | ----------- |
+| identity_providers | [IdentityProvider](#slash-store-IdentityProvider) | repeated |  |
+
+
+
+
+
+
 <a name="slash-store-WorkspaceSetting-ShortcutRelatedSetting"></a>
 
 ### WorkspaceSetting.ShortcutRelatedSetting
@@ -391,10 +513,11 @@
 | WORKSPACE_SETTING_KEY_UNSPECIFIED | 0 |  |
 | WORKSPACE_SETTING_GENERAL | 1 | Workspace general settings. |
 | WORKSPACE_SETTING_SHORTCUT_RELATED | 2 | Workspace shortcut-related settings. |
-| WORKSPACE_SETTING_LICENSE_KEY | 3 | TODO: remove the following keys. The license key. |
-| WORKSPACE_SETTING_SECRET_SESSION | 4 | The secret session key used to encrypt session data. |
-| WORKSPACE_SETTING_CUSTOM_STYLE | 5 | The custom style. |
-| WORKSPACE_SETTING_DEFAULT_VISIBILITY | 6 | The default visibility of shortcuts and collections. |
+| WORKSPACE_SETTING_IDENTITY_PROVIDER | 3 | Workspace identity provider settings. |
+| WORKSPACE_SETTING_LICENSE_KEY | 10 | TODO: remove the following keys. The license key. |
+| WORKSPACE_SETTING_SECRET_SESSION | 11 | The secret session key used to encrypt session data. |
+| WORKSPACE_SETTING_CUSTOM_STYLE | 12 | The custom style. |
+| WORKSPACE_SETTING_DEFAULT_VISIBILITY | 13 | The default visibility of shortcuts and collections. |
 
 
  
diff --git a/proto/gen/store/idp.pb.go b/proto/gen/store/idp.pb.go
new file mode 100644
index 0000000..8e7eb13
--- /dev/null
+++ b/proto/gen/store/idp.pb.go
@@ -0,0 +1,519 @@
+// Code generated by protoc-gen-go. DO NOT EDIT.
+// versions:
+// 	protoc-gen-go v1.34.2
+// 	protoc        (unknown)
+// source: store/idp.proto
+
+package store
+
+import (
+	protoreflect "google.golang.org/protobuf/reflect/protoreflect"
+	protoimpl "google.golang.org/protobuf/runtime/protoimpl"
+	reflect "reflect"
+	sync "sync"
+)
+
+const (
+	// Verify that this generated code is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion)
+	// Verify that runtime/protoimpl is sufficiently up-to-date.
+	_ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20)
+)
+
+type IdentityProvider_Type int32
+
+const (
+	IdentityProvider_TYPE_UNSPECIFIED IdentityProvider_Type = 0
+	IdentityProvider_OAUTH2           IdentityProvider_Type = 1
+)
+
+// Enum value maps for IdentityProvider_Type.
+var (
+	IdentityProvider_Type_name = map[int32]string{
+		0: "TYPE_UNSPECIFIED",
+		1: "OAUTH2",
+	}
+	IdentityProvider_Type_value = map[string]int32{
+		"TYPE_UNSPECIFIED": 0,
+		"OAUTH2":           1,
+	}
+)
+
+func (x IdentityProvider_Type) Enum() *IdentityProvider_Type {
+	p := new(IdentityProvider_Type)
+	*p = x
+	return p
+}
+
+func (x IdentityProvider_Type) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (IdentityProvider_Type) Descriptor() protoreflect.EnumDescriptor {
+	return file_store_idp_proto_enumTypes[0].Descriptor()
+}
+
+func (IdentityProvider_Type) Type() protoreflect.EnumType {
+	return &file_store_idp_proto_enumTypes[0]
+}
+
+func (x IdentityProvider_Type) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use IdentityProvider_Type.Descriptor instead.
+func (IdentityProvider_Type) EnumDescriptor() ([]byte, []int) {
+	return file_store_idp_proto_rawDescGZIP(), []int{0, 0}
+}
+
+type IdentityProvider struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Name   string                  `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
+	Type   IdentityProvider_Type   `protobuf:"varint,2,opt,name=type,proto3,enum=slash.store.IdentityProvider_Type" json:"type,omitempty"`
+	Config *IdentityProviderConfig `protobuf:"bytes,3,opt,name=config,proto3" json:"config,omitempty"`
+}
+
+func (x *IdentityProvider) Reset() {
+	*x = IdentityProvider{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_store_idp_proto_msgTypes[0]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *IdentityProvider) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IdentityProvider) ProtoMessage() {}
+
+func (x *IdentityProvider) ProtoReflect() protoreflect.Message {
+	mi := &file_store_idp_proto_msgTypes[0]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IdentityProvider.ProtoReflect.Descriptor instead.
+func (*IdentityProvider) Descriptor() ([]byte, []int) {
+	return file_store_idp_proto_rawDescGZIP(), []int{0}
+}
+
+func (x *IdentityProvider) GetName() string {
+	if x != nil {
+		return x.Name
+	}
+	return ""
+}
+
+func (x *IdentityProvider) GetType() IdentityProvider_Type {
+	if x != nil {
+		return x.Type
+	}
+	return IdentityProvider_TYPE_UNSPECIFIED
+}
+
+func (x *IdentityProvider) GetConfig() *IdentityProviderConfig {
+	if x != nil {
+		return x.Config
+	}
+	return nil
+}
+
+type IdentityProviderConfig struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	// Types that are assignable to Config:
+	//
+	//	*IdentityProviderConfig_Oauth2Config
+	Config isIdentityProviderConfig_Config `protobuf_oneof:"config"`
+}
+
+func (x *IdentityProviderConfig) Reset() {
+	*x = IdentityProviderConfig{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_store_idp_proto_msgTypes[1]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *IdentityProviderConfig) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IdentityProviderConfig) ProtoMessage() {}
+
+func (x *IdentityProviderConfig) ProtoReflect() protoreflect.Message {
+	mi := &file_store_idp_proto_msgTypes[1]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IdentityProviderConfig.ProtoReflect.Descriptor instead.
+func (*IdentityProviderConfig) Descriptor() ([]byte, []int) {
+	return file_store_idp_proto_rawDescGZIP(), []int{1}
+}
+
+func (m *IdentityProviderConfig) GetConfig() isIdentityProviderConfig_Config {
+	if m != nil {
+		return m.Config
+	}
+	return nil
+}
+
+func (x *IdentityProviderConfig) GetOauth2Config() *IdentityProviderConfig_OAuth2Config {
+	if x, ok := x.GetConfig().(*IdentityProviderConfig_Oauth2Config); ok {
+		return x.Oauth2Config
+	}
+	return nil
+}
+
+type isIdentityProviderConfig_Config interface {
+	isIdentityProviderConfig_Config()
+}
+
+type IdentityProviderConfig_Oauth2Config struct {
+	Oauth2Config *IdentityProviderConfig_OAuth2Config `protobuf:"bytes,1,opt,name=oauth2_config,json=oauth2Config,proto3,oneof"`
+}
+
+func (*IdentityProviderConfig_Oauth2Config) isIdentityProviderConfig_Config() {}
+
+type IdentityProviderConfig_FieldMapping struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Email       string `protobuf:"bytes,1,opt,name=email,proto3" json:"email,omitempty"`
+	DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
+}
+
+func (x *IdentityProviderConfig_FieldMapping) Reset() {
+	*x = IdentityProviderConfig_FieldMapping{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_store_idp_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *IdentityProviderConfig_FieldMapping) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IdentityProviderConfig_FieldMapping) ProtoMessage() {}
+
+func (x *IdentityProviderConfig_FieldMapping) ProtoReflect() protoreflect.Message {
+	mi := &file_store_idp_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IdentityProviderConfig_FieldMapping.ProtoReflect.Descriptor instead.
+func (*IdentityProviderConfig_FieldMapping) Descriptor() ([]byte, []int) {
+	return file_store_idp_proto_rawDescGZIP(), []int{1, 0}
+}
+
+func (x *IdentityProviderConfig_FieldMapping) GetEmail() string {
+	if x != nil {
+		return x.Email
+	}
+	return ""
+}
+
+func (x *IdentityProviderConfig_FieldMapping) GetDisplayName() string {
+	if x != nil {
+		return x.DisplayName
+	}
+	return ""
+}
+
+type IdentityProviderConfig_OAuth2Config struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	ClientId     string                               `protobuf:"bytes,1,opt,name=client_id,json=clientId,proto3" json:"client_id,omitempty"`
+	ClientSecret string                               `protobuf:"bytes,2,opt,name=client_secret,json=clientSecret,proto3" json:"client_secret,omitempty"`
+	AuthUrl      string                               `protobuf:"bytes,3,opt,name=auth_url,json=authUrl,proto3" json:"auth_url,omitempty"`
+	TokenUrl     string                               `protobuf:"bytes,4,opt,name=token_url,json=tokenUrl,proto3" json:"token_url,omitempty"`
+	UserInfoUrl  string                               `protobuf:"bytes,5,opt,name=user_info_url,json=userInfoUrl,proto3" json:"user_info_url,omitempty"`
+	Scopes       []string                             `protobuf:"bytes,6,rep,name=scopes,proto3" json:"scopes,omitempty"`
+	FieldMapping *IdentityProviderConfig_FieldMapping `protobuf:"bytes,7,opt,name=field_mapping,json=fieldMapping,proto3" json:"field_mapping,omitempty"`
+}
+
+func (x *IdentityProviderConfig_OAuth2Config) Reset() {
+	*x = IdentityProviderConfig_OAuth2Config{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_store_idp_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *IdentityProviderConfig_OAuth2Config) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*IdentityProviderConfig_OAuth2Config) ProtoMessage() {}
+
+func (x *IdentityProviderConfig_OAuth2Config) ProtoReflect() protoreflect.Message {
+	mi := &file_store_idp_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use IdentityProviderConfig_OAuth2Config.ProtoReflect.Descriptor instead.
+func (*IdentityProviderConfig_OAuth2Config) Descriptor() ([]byte, []int) {
+	return file_store_idp_proto_rawDescGZIP(), []int{1, 1}
+}
+
+func (x *IdentityProviderConfig_OAuth2Config) GetClientId() string {
+	if x != nil {
+		return x.ClientId
+	}
+	return ""
+}
+
+func (x *IdentityProviderConfig_OAuth2Config) GetClientSecret() string {
+	if x != nil {
+		return x.ClientSecret
+	}
+	return ""
+}
+
+func (x *IdentityProviderConfig_OAuth2Config) GetAuthUrl() string {
+	if x != nil {
+		return x.AuthUrl
+	}
+	return ""
+}
+
+func (x *IdentityProviderConfig_OAuth2Config) GetTokenUrl() string {
+	if x != nil {
+		return x.TokenUrl
+	}
+	return ""
+}
+
+func (x *IdentityProviderConfig_OAuth2Config) GetUserInfoUrl() string {
+	if x != nil {
+		return x.UserInfoUrl
+	}
+	return ""
+}
+
+func (x *IdentityProviderConfig_OAuth2Config) GetScopes() []string {
+	if x != nil {
+		return x.Scopes
+	}
+	return nil
+}
+
+func (x *IdentityProviderConfig_OAuth2Config) GetFieldMapping() *IdentityProviderConfig_FieldMapping {
+	if x != nil {
+		return x.FieldMapping
+	}
+	return nil
+}
+
+var File_store_idp_proto protoreflect.FileDescriptor
+
+var file_store_idp_proto_rawDesc = []byte{
+	0x0a, 0x0f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x69, 0x64, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x12, 0x0b, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x22, 0xc5,
+	0x01, 0x0a, 0x10, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x50, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x12, 0x12, 0x0a, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x04, 0x6e, 0x61, 0x6d, 0x65, 0x12, 0x36, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x22, 0x2e, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x73, 0x74,
+	0x6f, 0x72, 0x65, 0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x50, 0x72, 0x6f, 0x76,
+	0x69, 0x64, 0x65, 0x72, 0x2e, 0x54, 0x79, 0x70, 0x65, 0x52, 0x04, 0x74, 0x79, 0x70, 0x65, 0x12,
+	0x3b, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x23, 0x2e, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x49, 0x64,
+	0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x22, 0x28, 0x0a, 0x04,
+	0x54, 0x79, 0x70, 0x65, 0x12, 0x14, 0x0a, 0x10, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x53,
+	0x50, 0x45, 0x43, 0x49, 0x46, 0x49, 0x45, 0x44, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x4f, 0x41,
+	0x55, 0x54, 0x48, 0x32, 0x10, 0x01, 0x22, 0xe2, 0x03, 0x0a, 0x16, 0x49, 0x64, 0x65, 0x6e, 0x74,
+	0x69, 0x74, 0x79, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x12, 0x57, 0x0a, 0x0d, 0x6f, 0x61, 0x75, 0x74, 0x68, 0x32, 0x5f, 0x63, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x30, 0x2e, 0x73, 0x6c, 0x61, 0x73, 0x68,
+	0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x50,
+	0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x4f, 0x41,
+	0x75, 0x74, 0x68, 0x32, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x48, 0x00, 0x52, 0x0c, 0x6f, 0x61,
+	0x75, 0x74, 0x68, 0x32, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x47, 0x0a, 0x0c, 0x46, 0x69,
+	0x65, 0x6c, 0x64, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x6d,
+	0x61, 0x69, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x6d, 0x61, 0x69, 0x6c,
+	0x12, 0x21, 0x0a, 0x0c, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x5f, 0x6e, 0x61, 0x6d, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x64, 0x69, 0x73, 0x70, 0x6c, 0x61, 0x79, 0x4e,
+	0x61, 0x6d, 0x65, 0x1a, 0x9b, 0x02, 0x0a, 0x0c, 0x4f, 0x41, 0x75, 0x74, 0x68, 0x32, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x12, 0x1b, 0x0a, 0x09, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x69,
+	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x49,
+	0x64, 0x12, 0x23, 0x0a, 0x0d, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74, 0x5f, 0x73, 0x65, 0x63, 0x72,
+	0x65, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x63, 0x6c, 0x69, 0x65, 0x6e, 0x74,
+	0x53, 0x65, 0x63, 0x72, 0x65, 0x74, 0x12, 0x19, 0x0a, 0x08, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x75,
+	0x72, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x61, 0x75, 0x74, 0x68, 0x55, 0x72,
+	0x6c, 0x12, 0x1b, 0x0a, 0x09, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x55, 0x72, 0x6c, 0x12, 0x22,
+	0x0a, 0x0d, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x6e, 0x66, 0x6f, 0x5f, 0x75, 0x72, 0x6c, 0x18,
+	0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x75, 0x73, 0x65, 0x72, 0x49, 0x6e, 0x66, 0x6f, 0x55,
+	0x72, 0x6c, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x18, 0x06, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x06, 0x73, 0x63, 0x6f, 0x70, 0x65, 0x73, 0x12, 0x55, 0x0a, 0x0d, 0x66, 0x69,
+	0x65, 0x6c, 0x64, 0x5f, 0x6d, 0x61, 0x70, 0x70, 0x69, 0x6e, 0x67, 0x18, 0x07, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x30, 0x2e, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e,
+	0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4d, 0x61, 0x70, 0x70,
+	0x69, 0x6e, 0x67, 0x52, 0x0c, 0x66, 0x69, 0x65, 0x6c, 0x64, 0x4d, 0x61, 0x70, 0x70, 0x69, 0x6e,
+	0x67, 0x42, 0x08, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x42, 0x99, 0x01, 0x0a, 0x0f,
+	0x63, 0x6f, 0x6d, 0x2e, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x42,
+	0x08, 0x49, 0x64, 0x70, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x2f, 0x67, 0x69, 0x74,
+	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x79, 0x6f, 0x75, 0x72, 0x73, 0x65, 0x6c, 0x66,
+	0x68, 0x6f, 0x73, 0x74, 0x65, 0x64, 0x2f, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x2f, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0xa2, 0x02, 0x03, 0x53,
+	0x53, 0x58, 0xaa, 0x02, 0x0b, 0x53, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x53, 0x74, 0x6f, 0x72, 0x65,
+	0xca, 0x02, 0x0b, 0x53, 0x6c, 0x61, 0x73, 0x68, 0x5c, 0x53, 0x74, 0x6f, 0x72, 0x65, 0xe2, 0x02,
+	0x17, 0x53, 0x6c, 0x61, 0x73, 0x68, 0x5c, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x5c, 0x47, 0x50, 0x42,
+	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0c, 0x53, 0x6c, 0x61, 0x73, 0x68,
+	0x3a, 0x3a, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+}
+
+var (
+	file_store_idp_proto_rawDescOnce sync.Once
+	file_store_idp_proto_rawDescData = file_store_idp_proto_rawDesc
+)
+
+func file_store_idp_proto_rawDescGZIP() []byte {
+	file_store_idp_proto_rawDescOnce.Do(func() {
+		file_store_idp_proto_rawDescData = protoimpl.X.CompressGZIP(file_store_idp_proto_rawDescData)
+	})
+	return file_store_idp_proto_rawDescData
+}
+
+var file_store_idp_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
+var file_store_idp_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
+var file_store_idp_proto_goTypes = []any{
+	(IdentityProvider_Type)(0),                  // 0: slash.store.IdentityProvider.Type
+	(*IdentityProvider)(nil),                    // 1: slash.store.IdentityProvider
+	(*IdentityProviderConfig)(nil),              // 2: slash.store.IdentityProviderConfig
+	(*IdentityProviderConfig_FieldMapping)(nil), // 3: slash.store.IdentityProviderConfig.FieldMapping
+	(*IdentityProviderConfig_OAuth2Config)(nil), // 4: slash.store.IdentityProviderConfig.OAuth2Config
+}
+var file_store_idp_proto_depIdxs = []int32{
+	0, // 0: slash.store.IdentityProvider.type:type_name -> slash.store.IdentityProvider.Type
+	2, // 1: slash.store.IdentityProvider.config:type_name -> slash.store.IdentityProviderConfig
+	4, // 2: slash.store.IdentityProviderConfig.oauth2_config:type_name -> slash.store.IdentityProviderConfig.OAuth2Config
+	3, // 3: slash.store.IdentityProviderConfig.OAuth2Config.field_mapping:type_name -> slash.store.IdentityProviderConfig.FieldMapping
+	4, // [4:4] is the sub-list for method output_type
+	4, // [4:4] is the sub-list for method input_type
+	4, // [4:4] is the sub-list for extension type_name
+	4, // [4:4] is the sub-list for extension extendee
+	0, // [0:4] is the sub-list for field type_name
+}
+
+func init() { file_store_idp_proto_init() }
+func file_store_idp_proto_init() {
+	if File_store_idp_proto != nil {
+		return
+	}
+	if !protoimpl.UnsafeEnabled {
+		file_store_idp_proto_msgTypes[0].Exporter = func(v any, i int) any {
+			switch v := v.(*IdentityProvider); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_store_idp_proto_msgTypes[1].Exporter = func(v any, i int) any {
+			switch v := v.(*IdentityProviderConfig); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_store_idp_proto_msgTypes[2].Exporter = func(v any, i int) any {
+			switch v := v.(*IdentityProviderConfig_FieldMapping); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_store_idp_proto_msgTypes[3].Exporter = func(v any, i int) any {
+			switch v := v.(*IdentityProviderConfig_OAuth2Config); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+	}
+	file_store_idp_proto_msgTypes[1].OneofWrappers = []any{
+		(*IdentityProviderConfig_Oauth2Config)(nil),
+	}
+	type x struct{}
+	out := protoimpl.TypeBuilder{
+		File: protoimpl.DescBuilder{
+			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
+			RawDescriptor: file_store_idp_proto_rawDesc,
+			NumEnums:      1,
+			NumMessages:   4,
+			NumExtensions: 0,
+			NumServices:   0,
+		},
+		GoTypes:           file_store_idp_proto_goTypes,
+		DependencyIndexes: file_store_idp_proto_depIdxs,
+		EnumInfos:         file_store_idp_proto_enumTypes,
+		MessageInfos:      file_store_idp_proto_msgTypes,
+	}.Build()
+	File_store_idp_proto = out.File
+	file_store_idp_proto_rawDesc = nil
+	file_store_idp_proto_goTypes = nil
+	file_store_idp_proto_depIdxs = nil
+}
diff --git a/proto/gen/store/workspace_setting.pb.go b/proto/gen/store/workspace_setting.pb.go
index 5d2a44b..ab54e77 100644
--- a/proto/gen/store/workspace_setting.pb.go
+++ b/proto/gen/store/workspace_setting.pb.go
@@ -28,36 +28,40 @@ const (
 	WorkspaceSettingKey_WORKSPACE_SETTING_GENERAL WorkspaceSettingKey = 1
 	// Workspace shortcut-related settings.
 	WorkspaceSettingKey_WORKSPACE_SETTING_SHORTCUT_RELATED WorkspaceSettingKey = 2
+	// Workspace identity provider settings.
+	WorkspaceSettingKey_WORKSPACE_SETTING_IDENTITY_PROVIDER WorkspaceSettingKey = 3
 	// TODO: remove the following keys.
 	// The license key.
-	WorkspaceSettingKey_WORKSPACE_SETTING_LICENSE_KEY WorkspaceSettingKey = 3
+	WorkspaceSettingKey_WORKSPACE_SETTING_LICENSE_KEY WorkspaceSettingKey = 10
 	// The secret session key used to encrypt session data.
-	WorkspaceSettingKey_WORKSPACE_SETTING_SECRET_SESSION WorkspaceSettingKey = 4
+	WorkspaceSettingKey_WORKSPACE_SETTING_SECRET_SESSION WorkspaceSettingKey = 11
 	// The custom style.
-	WorkspaceSettingKey_WORKSPACE_SETTING_CUSTOM_STYLE WorkspaceSettingKey = 5
+	WorkspaceSettingKey_WORKSPACE_SETTING_CUSTOM_STYLE WorkspaceSettingKey = 12
 	// The default visibility of shortcuts and collections.
-	WorkspaceSettingKey_WORKSPACE_SETTING_DEFAULT_VISIBILITY WorkspaceSettingKey = 6
+	WorkspaceSettingKey_WORKSPACE_SETTING_DEFAULT_VISIBILITY WorkspaceSettingKey = 13
 )
 
 // Enum value maps for WorkspaceSettingKey.
 var (
 	WorkspaceSettingKey_name = map[int32]string{
-		0: "WORKSPACE_SETTING_KEY_UNSPECIFIED",
-		1: "WORKSPACE_SETTING_GENERAL",
-		2: "WORKSPACE_SETTING_SHORTCUT_RELATED",
-		3: "WORKSPACE_SETTING_LICENSE_KEY",
-		4: "WORKSPACE_SETTING_SECRET_SESSION",
-		5: "WORKSPACE_SETTING_CUSTOM_STYLE",
-		6: "WORKSPACE_SETTING_DEFAULT_VISIBILITY",
+		0:  "WORKSPACE_SETTING_KEY_UNSPECIFIED",
+		1:  "WORKSPACE_SETTING_GENERAL",
+		2:  "WORKSPACE_SETTING_SHORTCUT_RELATED",
+		3:  "WORKSPACE_SETTING_IDENTITY_PROVIDER",
+		10: "WORKSPACE_SETTING_LICENSE_KEY",
+		11: "WORKSPACE_SETTING_SECRET_SESSION",
+		12: "WORKSPACE_SETTING_CUSTOM_STYLE",
+		13: "WORKSPACE_SETTING_DEFAULT_VISIBILITY",
 	}
 	WorkspaceSettingKey_value = map[string]int32{
 		"WORKSPACE_SETTING_KEY_UNSPECIFIED":    0,
 		"WORKSPACE_SETTING_GENERAL":            1,
 		"WORKSPACE_SETTING_SHORTCUT_RELATED":   2,
-		"WORKSPACE_SETTING_LICENSE_KEY":        3,
-		"WORKSPACE_SETTING_SECRET_SESSION":     4,
-		"WORKSPACE_SETTING_CUSTOM_STYLE":       5,
-		"WORKSPACE_SETTING_DEFAULT_VISIBILITY": 6,
+		"WORKSPACE_SETTING_IDENTITY_PROVIDER":  3,
+		"WORKSPACE_SETTING_LICENSE_KEY":        10,
+		"WORKSPACE_SETTING_SECRET_SESSION":     11,
+		"WORKSPACE_SETTING_CUSTOM_STYLE":       12,
+		"WORKSPACE_SETTING_DEFAULT_VISIBILITY": 13,
 	}
 )
 
@@ -94,11 +98,12 @@ type WorkspaceSetting struct {
 	unknownFields protoimpl.UnknownFields
 
 	Key WorkspaceSettingKey `protobuf:"varint,1,opt,name=key,proto3,enum=slash.store.WorkspaceSettingKey" json:"key,omitempty"`
-	Raw string              `protobuf:"bytes,4,opt,name=raw,proto3" json:"raw,omitempty"`
+	Raw string              `protobuf:"bytes,2,opt,name=raw,proto3" json:"raw,omitempty"`
 	// Types that are assignable to Value:
 	//
 	//	*WorkspaceSetting_General
 	//	*WorkspaceSetting_ShortcutRelated
+	//	*WorkspaceSetting_IdentityProvider
 	Value isWorkspaceSetting_Value `protobuf_oneof:"value"`
 }
 
@@ -169,22 +174,35 @@ func (x *WorkspaceSetting) GetShortcutRelated() *WorkspaceSetting_ShortcutRelate
 	return nil
 }
 
+func (x *WorkspaceSetting) GetIdentityProvider() *WorkspaceSetting_IdentityProviderSetting {
+	if x, ok := x.GetValue().(*WorkspaceSetting_IdentityProvider); ok {
+		return x.IdentityProvider
+	}
+	return nil
+}
+
 type isWorkspaceSetting_Value interface {
 	isWorkspaceSetting_Value()
 }
 
 type WorkspaceSetting_General struct {
-	General *WorkspaceSetting_GeneralSetting `protobuf:"bytes,2,opt,name=general,proto3,oneof"`
+	General *WorkspaceSetting_GeneralSetting `protobuf:"bytes,3,opt,name=general,proto3,oneof"`
 }
 
 type WorkspaceSetting_ShortcutRelated struct {
-	ShortcutRelated *WorkspaceSetting_ShortcutRelatedSetting `protobuf:"bytes,3,opt,name=shortcut_related,json=shortcutRelated,proto3,oneof"`
+	ShortcutRelated *WorkspaceSetting_ShortcutRelatedSetting `protobuf:"bytes,4,opt,name=shortcut_related,json=shortcutRelated,proto3,oneof"`
+}
+
+type WorkspaceSetting_IdentityProvider struct {
+	IdentityProvider *WorkspaceSetting_IdentityProviderSetting `protobuf:"bytes,5,opt,name=identity_provider,json=identityProvider,proto3,oneof"`
 }
 
 func (*WorkspaceSetting_General) isWorkspaceSetting_Value() {}
 
 func (*WorkspaceSetting_ShortcutRelated) isWorkspaceSetting_Value() {}
 
+func (*WorkspaceSetting_IdentityProvider) isWorkspaceSetting_Value() {}
+
 type WorkspaceSetting_GeneralSetting struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -303,6 +321,53 @@ func (x *WorkspaceSetting_ShortcutRelatedSetting) GetDefaultVisibility() Visibil
 	return Visibility_VISIBILITY_UNSPECIFIED
 }
 
+type WorkspaceSetting_IdentityProviderSetting struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	IdentityProviders []*IdentityProvider `protobuf:"bytes,1,rep,name=identity_providers,json=identityProviders,proto3" json:"identity_providers,omitempty"`
+}
+
+func (x *WorkspaceSetting_IdentityProviderSetting) Reset() {
+	*x = WorkspaceSetting_IdentityProviderSetting{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_store_workspace_setting_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *WorkspaceSetting_IdentityProviderSetting) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*WorkspaceSetting_IdentityProviderSetting) ProtoMessage() {}
+
+func (x *WorkspaceSetting_IdentityProviderSetting) ProtoReflect() protoreflect.Message {
+	mi := &file_store_workspace_setting_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use WorkspaceSetting_IdentityProviderSetting.ProtoReflect.Descriptor instead.
+func (*WorkspaceSetting_IdentityProviderSetting) Descriptor() ([]byte, []int) {
+	return file_store_workspace_setting_proto_rawDescGZIP(), []int{0, 2}
+}
+
+func (x *WorkspaceSetting_IdentityProviderSetting) GetIdentityProviders() []*IdentityProvider {
+	if x != nil {
+		return x.IdentityProviders
+	}
+	return nil
+}
+
 var File_store_workspace_setting_proto protoreflect.FileDescriptor
 
 var file_store_workspace_setting_proto_rawDesc = []byte{
@@ -310,39 +375,53 @@ var file_store_workspace_setting_proto_rawDesc = []byte{
 	0x65, 0x5f, 0x73, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12,
 	0x0b, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x1a, 0x12, 0x73, 0x74,
 	0x6f, 0x72, 0x65, 0x2f, 0x63, 0x6f, 0x6d, 0x6d, 0x6f, 0x6e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x22, 0x8a, 0x04, 0x0a, 0x10, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x53, 0x65,
-	0x74, 0x74, 0x69, 0x6e, 0x67, 0x12, 0x32, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x0e, 0x32, 0x20, 0x2e, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65,
-	0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e,
-	0x67, 0x4b, 0x65, 0x79, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x61, 0x77,
-	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x61, 0x77, 0x12, 0x48, 0x0a, 0x07, 0x67,
-	0x65, 0x6e, 0x65, 0x72, 0x61, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x73,
-	0x6c, 0x61, 0x73, 0x68, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x73,
-	0x70, 0x61, 0x63, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x2e, 0x47, 0x65, 0x6e, 0x65,
-	0x72, 0x61, 0x6c, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x48, 0x00, 0x52, 0x07, 0x67, 0x65,
-	0x6e, 0x65, 0x72, 0x61, 0x6c, 0x12, 0x61, 0x0a, 0x10, 0x73, 0x68, 0x6f, 0x72, 0x74, 0x63, 0x75,
-	0x74, 0x5f, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32,
-	0x34, 0x2e, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x57, 0x6f,
-	0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x2e, 0x53,
-	0x68, 0x6f, 0x72, 0x74, 0x63, 0x75, 0x74, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x53, 0x65,
-	0x74, 0x74, 0x69, 0x6e, 0x67, 0x48, 0x00, 0x52, 0x0f, 0x73, 0x68, 0x6f, 0x72, 0x74, 0x63, 0x75,
-	0x74, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x1a, 0x97, 0x01, 0x0a, 0x0e, 0x47, 0x65, 0x6e,
-	0x65, 0x72, 0x61, 0x6c, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x12, 0x25, 0x0a, 0x0e, 0x73,
-	0x65, 0x63, 0x72, 0x65, 0x74, 0x5f, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0d, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69,
-	0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x63, 0x65, 0x6e, 0x73, 0x65, 0x5f, 0x6b, 0x65,
-	0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x6c, 0x69, 0x63, 0x65, 0x6e, 0x73, 0x65,
-	0x4b, 0x65, 0x79, 0x12, 0x1a, 0x0a, 0x08, 0x62, 0x72, 0x61, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x62, 0x72, 0x61, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x12,
-	0x21, 0x0a, 0x0c, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x5f, 0x73, 0x74, 0x79, 0x6c, 0x65, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d, 0x53, 0x74, 0x79,
-	0x6c, 0x65, 0x1a, 0x60, 0x0a, 0x16, 0x53, 0x68, 0x6f, 0x72, 0x74, 0x63, 0x75, 0x74, 0x52, 0x65,
-	0x6c, 0x61, 0x74, 0x65, 0x64, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x12, 0x46, 0x0a, 0x12,
-	0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x76, 0x69, 0x73, 0x69, 0x62, 0x69, 0x6c, 0x69,
-	0x74, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x17, 0x2e, 0x73, 0x6c, 0x61, 0x73, 0x68,
-	0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x56, 0x69, 0x73, 0x69, 0x62, 0x69, 0x6c, 0x69, 0x74,
-	0x79, 0x52, 0x11, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x56, 0x69, 0x73, 0x69, 0x62, 0x69,
-	0x6c, 0x69, 0x74, 0x79, 0x42, 0x07, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x2a, 0x9a, 0x02,
+	0x1a, 0x0f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2f, 0x69, 0x64, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x22, 0xd9, 0x05, 0x0a, 0x10, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x53,
+	0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x12, 0x32, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x0e, 0x32, 0x20, 0x2e, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x73, 0x74, 0x6f, 0x72,
+	0x65, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69,
+	0x6e, 0x67, 0x4b, 0x65, 0x79, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x72, 0x61,
+	0x77, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x72, 0x61, 0x77, 0x12, 0x48, 0x0a, 0x07,
+	0x67, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x2c, 0x2e,
+	0x73, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x57, 0x6f, 0x72, 0x6b,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x2e, 0x47, 0x65, 0x6e,
+	0x65, 0x72, 0x61, 0x6c, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x48, 0x00, 0x52, 0x07, 0x67,
+	0x65, 0x6e, 0x65, 0x72, 0x61, 0x6c, 0x12, 0x61, 0x0a, 0x10, 0x73, 0x68, 0x6f, 0x72, 0x74, 0x63,
+	0x75, 0x74, 0x5f, 0x72, 0x65, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x34, 0x2e, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x57,
+	0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x2e,
+	0x53, 0x68, 0x6f, 0x72, 0x74, 0x63, 0x75, 0x74, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x53,
+	0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x48, 0x00, 0x52, 0x0f, 0x73, 0x68, 0x6f, 0x72, 0x74, 0x63,
+	0x75, 0x74, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x12, 0x64, 0x0a, 0x11, 0x69, 0x64, 0x65,
+	0x6e, 0x74, 0x69, 0x74, 0x79, 0x5f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x35, 0x2e, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x73, 0x74, 0x6f,
+	0x72, 0x65, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x53, 0x65, 0x74, 0x74,
+	0x69, 0x6e, 0x67, 0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x50, 0x72, 0x6f, 0x76,
+	0x69, 0x64, 0x65, 0x72, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x48, 0x00, 0x52, 0x10, 0x69,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x1a,
+	0x97, 0x01, 0x0a, 0x0e, 0x47, 0x65, 0x6e, 0x65, 0x72, 0x61, 0x6c, 0x53, 0x65, 0x74, 0x74, 0x69,
+	0x6e, 0x67, 0x12, 0x25, 0x0a, 0x0e, 0x73, 0x65, 0x63, 0x72, 0x65, 0x74, 0x5f, 0x73, 0x65, 0x73,
+	0x73, 0x69, 0x6f, 0x6e, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x73, 0x65, 0x63, 0x72,
+	0x65, 0x74, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x6c, 0x69, 0x63,
+	0x65, 0x6e, 0x73, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a,
+	0x6c, 0x69, 0x63, 0x65, 0x6e, 0x73, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x1a, 0x0a, 0x08, 0x62, 0x72,
+	0x61, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x62, 0x72,
+	0x61, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x12, 0x21, 0x0a, 0x0c, 0x63, 0x75, 0x73, 0x74, 0x6f, 0x6d,
+	0x5f, 0x73, 0x74, 0x79, 0x6c, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x63, 0x75,
+	0x73, 0x74, 0x6f, 0x6d, 0x53, 0x74, 0x79, 0x6c, 0x65, 0x1a, 0x60, 0x0a, 0x16, 0x53, 0x68, 0x6f,
+	0x72, 0x74, 0x63, 0x75, 0x74, 0x52, 0x65, 0x6c, 0x61, 0x74, 0x65, 0x64, 0x53, 0x65, 0x74, 0x74,
+	0x69, 0x6e, 0x67, 0x12, 0x46, 0x0a, 0x12, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x5f, 0x76,
+	0x69, 0x73, 0x69, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32,
+	0x17, 0x2e, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x2e, 0x56, 0x69,
+	0x73, 0x69, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x52, 0x11, 0x64, 0x65, 0x66, 0x61, 0x75, 0x6c,
+	0x74, 0x56, 0x69, 0x73, 0x69, 0x62, 0x69, 0x6c, 0x69, 0x74, 0x79, 0x1a, 0x67, 0x0a, 0x17, 0x49,
+	0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x53,
+	0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x12, 0x4c, 0x0a, 0x12, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69,
+	0x74, 0x79, 0x5f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x18, 0x01, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65,
+	0x2e, 0x49, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65,
+	0x72, 0x52, 0x11, 0x69, 0x64, 0x65, 0x6e, 0x74, 0x69, 0x74, 0x79, 0x50, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x73, 0x42, 0x07, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x2a, 0xc3, 0x02,
 	0x0a, 0x13, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69,
 	0x6e, 0x67, 0x4b, 0x65, 0x79, 0x12, 0x25, 0x0a, 0x21, 0x57, 0x4f, 0x52, 0x4b, 0x53, 0x50, 0x41,
 	0x43, 0x45, 0x5f, 0x53, 0x45, 0x54, 0x54, 0x49, 0x4e, 0x47, 0x5f, 0x4b, 0x45, 0x59, 0x5f, 0x55,
@@ -351,27 +430,30 @@ var file_store_workspace_setting_proto_rawDesc = []byte{
 	0x47, 0x5f, 0x47, 0x45, 0x4e, 0x45, 0x52, 0x41, 0x4c, 0x10, 0x01, 0x12, 0x26, 0x0a, 0x22, 0x57,
 	0x4f, 0x52, 0x4b, 0x53, 0x50, 0x41, 0x43, 0x45, 0x5f, 0x53, 0x45, 0x54, 0x54, 0x49, 0x4e, 0x47,
 	0x5f, 0x53, 0x48, 0x4f, 0x52, 0x54, 0x43, 0x55, 0x54, 0x5f, 0x52, 0x45, 0x4c, 0x41, 0x54, 0x45,
-	0x44, 0x10, 0x02, 0x12, 0x21, 0x0a, 0x1d, 0x57, 0x4f, 0x52, 0x4b, 0x53, 0x50, 0x41, 0x43, 0x45,
-	0x5f, 0x53, 0x45, 0x54, 0x54, 0x49, 0x4e, 0x47, 0x5f, 0x4c, 0x49, 0x43, 0x45, 0x4e, 0x53, 0x45,
-	0x5f, 0x4b, 0x45, 0x59, 0x10, 0x03, 0x12, 0x24, 0x0a, 0x20, 0x57, 0x4f, 0x52, 0x4b, 0x53, 0x50,
-	0x41, 0x43, 0x45, 0x5f, 0x53, 0x45, 0x54, 0x54, 0x49, 0x4e, 0x47, 0x5f, 0x53, 0x45, 0x43, 0x52,
-	0x45, 0x54, 0x5f, 0x53, 0x45, 0x53, 0x53, 0x49, 0x4f, 0x4e, 0x10, 0x04, 0x12, 0x22, 0x0a, 0x1e,
+	0x44, 0x10, 0x02, 0x12, 0x27, 0x0a, 0x23, 0x57, 0x4f, 0x52, 0x4b, 0x53, 0x50, 0x41, 0x43, 0x45,
+	0x5f, 0x53, 0x45, 0x54, 0x54, 0x49, 0x4e, 0x47, 0x5f, 0x49, 0x44, 0x45, 0x4e, 0x54, 0x49, 0x54,
+	0x59, 0x5f, 0x50, 0x52, 0x4f, 0x56, 0x49, 0x44, 0x45, 0x52, 0x10, 0x03, 0x12, 0x21, 0x0a, 0x1d,
 	0x57, 0x4f, 0x52, 0x4b, 0x53, 0x50, 0x41, 0x43, 0x45, 0x5f, 0x53, 0x45, 0x54, 0x54, 0x49, 0x4e,
-	0x47, 0x5f, 0x43, 0x55, 0x53, 0x54, 0x4f, 0x4d, 0x5f, 0x53, 0x54, 0x59, 0x4c, 0x45, 0x10, 0x05,
-	0x12, 0x28, 0x0a, 0x24, 0x57, 0x4f, 0x52, 0x4b, 0x53, 0x50, 0x41, 0x43, 0x45, 0x5f, 0x53, 0x45,
-	0x54, 0x54, 0x49, 0x4e, 0x47, 0x5f, 0x44, 0x45, 0x46, 0x41, 0x55, 0x4c, 0x54, 0x5f, 0x56, 0x49,
-	0x53, 0x49, 0x42, 0x49, 0x4c, 0x49, 0x54, 0x59, 0x10, 0x06, 0x42, 0xa6, 0x01, 0x0a, 0x0f, 0x63,
-	0x6f, 0x6d, 0x2e, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x42, 0x15,
-	0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67,
-	0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01, 0x5a, 0x2f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e,
-	0x63, 0x6f, 0x6d, 0x2f, 0x79, 0x6f, 0x75, 0x72, 0x73, 0x65, 0x6c, 0x66, 0x68, 0x6f, 0x73, 0x74,
-	0x65, 0x64, 0x2f, 0x73, 0x6c, 0x61, 0x73, 0x68, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67,
-	0x65, 0x6e, 0x2f, 0x73, 0x74, 0x6f, 0x72, 0x65, 0xa2, 0x02, 0x03, 0x53, 0x53, 0x58, 0xaa, 0x02,
-	0x0b, 0x53, 0x6c, 0x61, 0x73, 0x68, 0x2e, 0x53, 0x74, 0x6f, 0x72, 0x65, 0xca, 0x02, 0x0b, 0x53,
-	0x6c, 0x61, 0x73, 0x68, 0x5c, 0x53, 0x74, 0x6f, 0x72, 0x65, 0xe2, 0x02, 0x17, 0x53, 0x6c, 0x61,
-	0x73, 0x68, 0x5c, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0c, 0x53, 0x6c, 0x61, 0x73, 0x68, 0x3a, 0x3a, 0x53, 0x74,
-	0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x47, 0x5f, 0x4c, 0x49, 0x43, 0x45, 0x4e, 0x53, 0x45, 0x5f, 0x4b, 0x45, 0x59, 0x10, 0x0a, 0x12,
+	0x24, 0x0a, 0x20, 0x57, 0x4f, 0x52, 0x4b, 0x53, 0x50, 0x41, 0x43, 0x45, 0x5f, 0x53, 0x45, 0x54,
+	0x54, 0x49, 0x4e, 0x47, 0x5f, 0x53, 0x45, 0x43, 0x52, 0x45, 0x54, 0x5f, 0x53, 0x45, 0x53, 0x53,
+	0x49, 0x4f, 0x4e, 0x10, 0x0b, 0x12, 0x22, 0x0a, 0x1e, 0x57, 0x4f, 0x52, 0x4b, 0x53, 0x50, 0x41,
+	0x43, 0x45, 0x5f, 0x53, 0x45, 0x54, 0x54, 0x49, 0x4e, 0x47, 0x5f, 0x43, 0x55, 0x53, 0x54, 0x4f,
+	0x4d, 0x5f, 0x53, 0x54, 0x59, 0x4c, 0x45, 0x10, 0x0c, 0x12, 0x28, 0x0a, 0x24, 0x57, 0x4f, 0x52,
+	0x4b, 0x53, 0x50, 0x41, 0x43, 0x45, 0x5f, 0x53, 0x45, 0x54, 0x54, 0x49, 0x4e, 0x47, 0x5f, 0x44,
+	0x45, 0x46, 0x41, 0x55, 0x4c, 0x54, 0x5f, 0x56, 0x49, 0x53, 0x49, 0x42, 0x49, 0x4c, 0x49, 0x54,
+	0x59, 0x10, 0x0d, 0x42, 0xa6, 0x01, 0x0a, 0x0f, 0x63, 0x6f, 0x6d, 0x2e, 0x73, 0x6c, 0x61, 0x73,
+	0x68, 0x2e, 0x73, 0x74, 0x6f, 0x72, 0x65, 0x42, 0x15, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x53, 0x65, 0x74, 0x74, 0x69, 0x6e, 0x67, 0x50, 0x72, 0x6f, 0x74, 0x6f, 0x50, 0x01,
+	0x5a, 0x2f, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x79, 0x6f, 0x75,
+	0x72, 0x73, 0x65, 0x6c, 0x66, 0x68, 0x6f, 0x73, 0x74, 0x65, 0x64, 0x2f, 0x73, 0x6c, 0x61, 0x73,
+	0x68, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x65, 0x6e, 0x2f, 0x73, 0x74, 0x6f, 0x72,
+	0x65, 0xa2, 0x02, 0x03, 0x53, 0x53, 0x58, 0xaa, 0x02, 0x0b, 0x53, 0x6c, 0x61, 0x73, 0x68, 0x2e,
+	0x53, 0x74, 0x6f, 0x72, 0x65, 0xca, 0x02, 0x0b, 0x53, 0x6c, 0x61, 0x73, 0x68, 0x5c, 0x53, 0x74,
+	0x6f, 0x72, 0x65, 0xe2, 0x02, 0x17, 0x53, 0x6c, 0x61, 0x73, 0x68, 0x5c, 0x53, 0x74, 0x6f, 0x72,
+	0x65, 0x5c, 0x47, 0x50, 0x42, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0xea, 0x02, 0x0c,
+	0x53, 0x6c, 0x61, 0x73, 0x68, 0x3a, 0x3a, 0x53, 0x74, 0x6f, 0x72, 0x65, 0x62, 0x06, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -387,24 +469,28 @@ func file_store_workspace_setting_proto_rawDescGZIP() []byte {
 }
 
 var file_store_workspace_setting_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_store_workspace_setting_proto_msgTypes = make([]protoimpl.MessageInfo, 3)
+var file_store_workspace_setting_proto_msgTypes = make([]protoimpl.MessageInfo, 4)
 var file_store_workspace_setting_proto_goTypes = []any{
-	(WorkspaceSettingKey)(0),                        // 0: slash.store.WorkspaceSettingKey
-	(*WorkspaceSetting)(nil),                        // 1: slash.store.WorkspaceSetting
-	(*WorkspaceSetting_GeneralSetting)(nil),         // 2: slash.store.WorkspaceSetting.GeneralSetting
-	(*WorkspaceSetting_ShortcutRelatedSetting)(nil), // 3: slash.store.WorkspaceSetting.ShortcutRelatedSetting
-	(Visibility)(0),                                 // 4: slash.store.Visibility
+	(WorkspaceSettingKey)(0),                         // 0: slash.store.WorkspaceSettingKey
+	(*WorkspaceSetting)(nil),                         // 1: slash.store.WorkspaceSetting
+	(*WorkspaceSetting_GeneralSetting)(nil),          // 2: slash.store.WorkspaceSetting.GeneralSetting
+	(*WorkspaceSetting_ShortcutRelatedSetting)(nil),  // 3: slash.store.WorkspaceSetting.ShortcutRelatedSetting
+	(*WorkspaceSetting_IdentityProviderSetting)(nil), // 4: slash.store.WorkspaceSetting.IdentityProviderSetting
+	(Visibility)(0),                                  // 5: slash.store.Visibility
+	(*IdentityProvider)(nil),                         // 6: slash.store.IdentityProvider
 }
 var file_store_workspace_setting_proto_depIdxs = []int32{
 	0, // 0: slash.store.WorkspaceSetting.key:type_name -> slash.store.WorkspaceSettingKey
 	2, // 1: slash.store.WorkspaceSetting.general:type_name -> slash.store.WorkspaceSetting.GeneralSetting
 	3, // 2: slash.store.WorkspaceSetting.shortcut_related:type_name -> slash.store.WorkspaceSetting.ShortcutRelatedSetting
-	4, // 3: slash.store.WorkspaceSetting.ShortcutRelatedSetting.default_visibility:type_name -> slash.store.Visibility
-	4, // [4:4] is the sub-list for method output_type
-	4, // [4:4] is the sub-list for method input_type
-	4, // [4:4] is the sub-list for extension type_name
-	4, // [4:4] is the sub-list for extension extendee
-	0, // [0:4] is the sub-list for field type_name
+	4, // 3: slash.store.WorkspaceSetting.identity_provider:type_name -> slash.store.WorkspaceSetting.IdentityProviderSetting
+	5, // 4: slash.store.WorkspaceSetting.ShortcutRelatedSetting.default_visibility:type_name -> slash.store.Visibility
+	6, // 5: slash.store.WorkspaceSetting.IdentityProviderSetting.identity_providers:type_name -> slash.store.IdentityProvider
+	6, // [6:6] is the sub-list for method output_type
+	6, // [6:6] is the sub-list for method input_type
+	6, // [6:6] is the sub-list for extension type_name
+	6, // [6:6] is the sub-list for extension extendee
+	0, // [0:6] is the sub-list for field type_name
 }
 
 func init() { file_store_workspace_setting_proto_init() }
@@ -413,6 +499,7 @@ func file_store_workspace_setting_proto_init() {
 		return
 	}
 	file_store_common_proto_init()
+	file_store_idp_proto_init()
 	if !protoimpl.UnsafeEnabled {
 		file_store_workspace_setting_proto_msgTypes[0].Exporter = func(v any, i int) any {
 			switch v := v.(*WorkspaceSetting); i {
@@ -450,10 +537,23 @@ func file_store_workspace_setting_proto_init() {
 				return nil
 			}
 		}
+		file_store_workspace_setting_proto_msgTypes[3].Exporter = func(v any, i int) any {
+			switch v := v.(*WorkspaceSetting_IdentityProviderSetting); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	file_store_workspace_setting_proto_msgTypes[0].OneofWrappers = []any{
 		(*WorkspaceSetting_General)(nil),
 		(*WorkspaceSetting_ShortcutRelated)(nil),
+		(*WorkspaceSetting_IdentityProvider)(nil),
 	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
@@ -461,7 +561,7 @@ func file_store_workspace_setting_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_store_workspace_setting_proto_rawDesc,
 			NumEnums:      1,
-			NumMessages:   3,
+			NumMessages:   4,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/proto/store/idp.proto b/proto/store/idp.proto
new file mode 100644
index 0000000..23a85b4
--- /dev/null
+++ b/proto/store/idp.proto
@@ -0,0 +1,37 @@
+syntax = "proto3";
+
+package slash.store;
+
+option go_package = "gen/store";
+
+message IdentityProvider {
+  string name = 1;
+
+  enum Type {
+    TYPE_UNSPECIFIED = 0;
+    OAUTH2 = 1;
+  }
+  Type type = 2;
+  IdentityProviderConfig config = 3;
+}
+
+message IdentityProviderConfig {
+  oneof config {
+    OAuth2Config oauth2_config = 1;
+  }
+
+  message FieldMapping {
+    string email = 1;
+    string display_name = 2;
+  }
+
+  message OAuth2Config {
+    string client_id = 1;
+    string client_secret = 2;
+    string auth_url = 3;
+    string token_url = 4;
+    string user_info_url = 5;
+    repeated string scopes = 6;
+    FieldMapping field_mapping = 7;
+  }
+}
diff --git a/proto/store/workspace_setting.proto b/proto/store/workspace_setting.proto
index 4eb23cf..7283580 100644
--- a/proto/store/workspace_setting.proto
+++ b/proto/store/workspace_setting.proto
@@ -3,16 +3,18 @@ syntax = "proto3";
 package slash.store;
 
 import "store/common.proto";
+import "store/idp.proto";
 
 option go_package = "gen/store";
 
 message WorkspaceSetting {
   WorkspaceSettingKey key = 1;
-  string raw = 4;
+  string raw = 2;
 
   oneof value {
-    GeneralSetting general = 2;
-    ShortcutRelatedSetting shortcut_related = 3;
+    GeneralSetting general = 3;
+    ShortcutRelatedSetting shortcut_related = 4;
+    IdentityProviderSetting identity_provider = 5;
   }
 
   message GeneralSetting {
@@ -25,6 +27,10 @@ message WorkspaceSetting {
   message ShortcutRelatedSetting {
     Visibility default_visibility = 1;
   }
+
+  message IdentityProviderSetting {
+    repeated IdentityProvider identity_providers = 1;
+  }
 }
 
 enum WorkspaceSettingKey {
@@ -33,14 +39,16 @@ enum WorkspaceSettingKey {
   WORKSPACE_SETTING_GENERAL = 1;
   // Workspace shortcut-related settings.
   WORKSPACE_SETTING_SHORTCUT_RELATED = 2;
+  // Workspace identity provider settings.
+  WORKSPACE_SETTING_IDENTITY_PROVIDER = 3;
 
   // TODO: remove the following keys.
   // The license key.
-  WORKSPACE_SETTING_LICENSE_KEY = 3;
+  WORKSPACE_SETTING_LICENSE_KEY = 10;
   // The secret session key used to encrypt session data.
-  WORKSPACE_SETTING_SECRET_SESSION = 4;
+  WORKSPACE_SETTING_SECRET_SESSION = 11;
   // The custom style.
-  WORKSPACE_SETTING_CUSTOM_STYLE = 5;
+  WORKSPACE_SETTING_CUSTOM_STYLE = 12;
   // The default visibility of shortcuts and collections.
-  WORKSPACE_SETTING_DEFAULT_VISIBILITY = 6;
+  WORKSPACE_SETTING_DEFAULT_VISIBILITY = 13;
 }