# Zero Fundamentals: Configure a Custom Identity Provider

So far, you've been using our [Hosted Authenticate service](https://www.pomerium.com/docs/capabilities/authentication.md), which provides a hosted authenticate service URL (`authenticate.pomerium.app`) and Pomerium's hosted identity provider to authenticate users.

In this guide, you'll replace Pomerium's hosted identity provider with your own custom identity provider to handle authentication.

Make sure you've completed the following tutorials:

- [**Build a Simple Route**](https://www.pomerium.com/docs/get-started/fundamentals/zero/zero-build-routes.md)
- [**Build a Simple Policy**](https://www.pomerium.com/docs/get-started/fundamentals/zero/zero-build-policies.md)
- [**Single Sign-on with JWTs**](https://www.pomerium.com/docs/get-started/fundamentals/zero/zero-single-sign-on.md)
- [**Build Advanced Policies**](https://www.pomerium.com/docs/get-started/fundamentals/zero/zero-advanced-policies.md)
- [**Build Advanced Routes**](https://www.pomerium.com/docs/get-started/fundamentals/zero/zero-advanced-routes.md)
- [**Build TCP Routes**](https://www.pomerium.com/docs/get-started/fundamentals/zero/zero-tcp-routes.md)

Each tutorial builds on the same configuration files. In this guide, you'll replace our hosted identity provider solution with your own custom identity provider.

## Choose an identity provider

You can integrate Pomerium with any identity provider (IdP) that supports the OAuth2.0 and OIDC protocols. For the purposes of this guide, we will use [GitHub](https://www.pomerium.com/docs/integrations/user-identity/github.md) as the IdP (the configuration is simpler than other IdPs).

If you prefer to use another IdP instead of GitHub, feel free to do so. You can refer to our identity provider guides for setup instructions.

- [Apple](https://www.pomerium.com/docs/integrations/user-identity/apple.md)
- [Auth0](https://www.pomerium.com/docs/integrations/user-identity/auth0.md)
- [Microsoft Entra ID (Azure AD)](https://www.pomerium.com/docs/integrations/user-identity/azure.md)
- [Cognito](https://www.pomerium.com/docs/integrations/user-identity/cognito.md)
- [GitHub](https://www.pomerium.com/docs/integrations/user-identity/github.md)
- [GitLab](https://www.pomerium.com/docs/integrations/user-identity/gitlab.md)
- [Google](https://www.pomerium.com/docs/integrations/user-identity/google.md)
- [Okta](https://www.pomerium.com/docs/integrations/user-identity/okta.md)
- [OneLogin](https://www.pomerium.com/docs/integrations/user-identity/one-login.md)
- [Ping Identity](https://www.pomerium.com/docs/integrations/user-identity/ping.md)
- [OIDC](https://www.pomerium.com/docs/integrations/user-identity/oidc.md)

## Configure your identity provider

In the Zero Console:

1. select **Settings**
2. Scroll to **Identity Provider**
3. Select **Custom Identity Provider**
4. In the **Identity Provider** dropdown, select **GitHub**
5. Enter your **Client ID** and **Client Secret**
6. Enter your **Authenticate Service URL**

If you still want to use Pomerium's authenticate service URL instead of your own, enter a URL with this format:

`authenticate.<CLUSTER_SUBDOMAIN>.pomerium.app`

\[Configuring GitHub as an identity provider in Pomerium Zero]

Skip the advanced settings (unless you need to configure these for your IdP) and save your changes.

## Test the IdP integration

Now, when you access a route:

1. Pomerium will redirect you to the configured IdP to authenticate.
2. Upon successful authentication, the IdP will redirect you back to Pomerium's authenticate service with the Pomerium-managed service URL.
3. Pomerium's proxy service will forward your request to the upstream service.

\[GIF demonstrating identity provider authentication flow with Pomerium.]

## Next Steps: Add a Custom Domain

That's it for our Pomerium Zero courses, but if you want to continue learning how to use Pomerium Zero, try adding a [Custom Domain](https://www.pomerium.com/docs/capabilities/custom-domains.md).

From there, you can also check out any of our [Guides](https://www.pomerium.com/docs/guides) to learn how to secure common apps and services behind Pomerium.