AWS SSO OIDC MCP Server Integration

The AWS IAM Identity Center OIDC API, formerly known as AWS Single Sign-On, is a foundational web service provided by Amazon Web Services that enables client applications—ranging from command-line tools like the AWS CLI to custom native desktop and mobile applications—to register themselves with IAM Identity Center and obtain short-lived user access tokens through an OpenID Connect authentication flow. At its core, the API exposes three critical endpoints: POST /client/register, which allows applications to register as OIDC clients and receive a unique client ID and client secret; POST /device_authorization, which initiates a device code flow by issuing a device code and user code pair along with a verification URI for the end user to authenticate via a browser; and POST /token, which exchanges a valid authorization code or device code for an access token (and optionally a refresh token) that grants the client scoped access to AWS accounts and assigned permissions. This service is indispensable in enterprise environments where organizations manage workforce identities centrally through IAM Identity Center, federating access across multiple AWS accounts, SaaS applications, and custom line-of-business tools. Typical use cases include enabling single sign-on for developer workstations accessing multiple AWS accounts, powering CLI-based automation scripts that need to operate under a user's delegated permissions, and integrating third-party applications with corporate identity providers such as Azure AD, Okta, or Ping Identity through the SAML-to-OIDC bridge that IAM Identity Center provides.