xCloud
configure_realm
Change how an application's end users sign in: its realm's sign-in methods (`google`, `github`, `passkey`, `email`, `entra`, `apple`) and whether account creation is open or by invitation only. It also sets the account, sign-in, and emailed-code limits, invitation and session lifetimes, and Entra settings. The `apple` member names the Services ID, the team and key identifiers, and the stored signing key's name. The `session_cap_days` member caps a native session's days. The `clients` member lists the native apps signing in through the realm, each a `client_id` with its redirect URIs and app signing identities. Raising a client's `minimum_version` answers `warnings`, the in-use versions it refuses. Only supplied members change; `sign_in_methods` and `clients` each replace their list. The manifest must declare the accounts service. Omit `application` only as a platform operator to change the builder realm's `creation` mode, `limits.creation_ceiling`, or `limits.site_public`, other members refused. An optional `environment` (`development` or `production`; absent, `production`) names the realm addressed. A field the manifest's `realm` member names is refused `manifest_owned_field`: the manifest may own `sign_in_methods`, `creation`, `entra`, and `apple`, while `clients`, the limits, and the lifetimes are set here alone. The `entra` member's `client_secret_name` and the `apple` member's `key_secret_name` each take the name of a stored secret, never its value. The rest is on the page /cloud/reference/actions/configure-realm/, which `read_documentation` reads as `page` and the platform's origin serves.
Remote (network-hosted)
Other tools also called configure_realm?
See providers with this name
Input Schema
{
"type": "object",
"properties": {
"apple": {
"type": "object",
"required": [
"services_id",
"team_id",
"key_id",
"key_secret_name"
],
"properties": {
"key_id": {
"type": "string",
"pattern": "^[A-Z0-9]{10}$",
"description": "The Sign in with Apple key's ten-character identifier."
},
"team_id": {
"type": "string",
"pattern": "^[A-Z0-9]{10}$",
"description": "The developer team's ten-character identifier."
},
"services_id": {
"type": "string",
"description": "The Services ID registered with Apple for the web sign-in."
},
"key_secret_name": {
"type": "string",
"description": "The name the key's `.p8` text was stored under with `store_secret` naming this application — the name, never the value."
}
},
"description": "Sign in with Apple.",
"additionalProperties": false
},
"entra": {
"type": "object",
"required": [
"tenant",
"client_id",
"client_secret_name"
],
"properties": {
"tenant": {
"type": "string",
"description": "The Microsoft Entra tenant id, a GUID."
},
"client_id": {
"type": "string",
"description": "The client id of the app registration in that tenant."
},
"client_secret_name": {
"type": "string",
"description": "The name the client secret was stored under with `store_secret` naming this application — the name, never the value."
}
},
"description": "The work-account route for a company's Microsoft Entra tenant.",
"additionalProperties": false
},
"limits": {
"type": "object",
"properties": {
"site_public": {
"type": [
"boolean",
"null"
],
"description": "The builder realm alone, with no application. Refused by name on an application's realm."
},
"creation_ceiling": {
"anyOf": [
{
"type": "integer",
"minimum": 1
},
{
"type": "null"
}
],
"description": "End-user realm: most accounts (1000 unset). Builder realm: most open sign-ups."
},
"code_sends_per_hour": {
"type": "integer",
"minimum": 1,
"description": "Emailed sign-in codes sent per address per hour; 5 where none is set, and at most 30."
},
"signin_starts_per_hour": {
"type": "integer",
"minimum": 1,
"description": "Sign-in starts allowed per source address per hour; 30 where none is set."
}
},
"description": "The realm's limits. Pass only the members you change.",
"additionalProperties": false
},
"clients": {
"type": "array",
"items": {
"type": "object",
"required": [
"client_id",
"redirect_uris"
],
"properties": {
"ios": {
"type": "object",
"required": [
"bundle_id",
"team_id"
],
"properties": {
"team_id": {
"type": "string"
},
"bundle_id": {
"type": "string"
}
},
"description": "The iOS app's bundle identifier and its ten-character team identifier.",
"additionalProperties": false
},
"android": {
"type": "object",
"required": [
"package",
"sha256_cert_fingerprints"
],
"properties": {
"package": {
"type": "string"
},
"sha256_cert_fingerprints": {
"type": "array",
"items": {
"type": "string"
}
}
},
"description": "The Android app's package name and its signing-certificate SHA-256 fingerprints, each 32 upper-case hex pairs separated by colons.",
"additionalProperties": false
},
"client_id": {
"type": "string",
"description": "The client's identifier: letters, digits, dots, underscores, colons, and hyphens."
},
"update_url": {
"type": "string",
"description": "An `https` URL where a refused client is sent to update."
},
"redirect_uris": {
"type": "array",
"items": {
"type": "string"
},
"description": "The redirect URIs the client presents: a reverse-domain custom scheme, an `https` URI on one of the application's own hostnames, or a loopback `http` URI on `localhost`, `[::1]`, or 127.0.0.0/8. Any other form is refused `invalid_redirect_uri`."
},
"minimum_version": {
"type": "string",
"description": "The oldest app version the router admits, as `major.minor.patch`."
},
"google_client_ids": {
"type": "array",
"items": {
"type": "string"
},
"description": "The Google client identifiers a Google ID token names as its audience."
}
},
"additionalProperties": false
},
"description": "The realm's native public clients, at most ten, replacing the current list. On one environment the production realm takes both builds' redirect URIs; with development turned on, the development realm takes the debug build's and the production realm the store build's."
},
"creation": {
"enum": [
"open",
"invited"
],
"type": "string",
"description": "Who may create an account by signing in: `open`, anyone, the default, or `invited`, only the holder of an invitation from `issue_invitation`. Under a manifest's `invited` audience `open` is refused `creation_contradicts_audience`."
},
"application": {
"type": "string",
"description": "The application id whose realm to configure (see `list_applications`); its manifest must declare the accounts service."
},
"environment": {
"type": "string",
"pattern": "^(development|production)$",
"description": "The environment whose realm the call addresses, `development` or `production`; absent, `production`."
},
"session_days": {
"type": "integer",
"maximum": 30,
"minimum": 1,
"description": "How many days a session the realm opens lives: 30 where none is set."
},
"invitation_days": {
"type": "integer",
"minimum": 1,
"description": "How many days an invitation from `issue_invitation` stays redeemable; 14 where none is set."
},
"sign_in_methods": {
"type": "array",
"items": {
"enum": [
"google",
"github",
"passkey",
"email",
"entra",
"apple"
],
"type": "string"
},
"description": "The enabled sign-in methods, replacing the current set. An empty set admits no sign-in, and `passkey` alone is refused. Naming `entra` or `apple` needs that member in this call or an earlier one. An invitation-only realm refuses `entra`, and a workforce audience allows `entra` alone."
},
"session_cap_days": {
"type": "integer",
"maximum": 730,
"minimum": 1,
"description": "How many days a native session may run from its creation: 365 where none is set, and no smaller than `session_days`."
}
}
}