IdPs like Microsoft, Google, Okta, Ping, etc do not want us to have a generic, pluggable interface to them.
If there were a simple, universal API spec: You could swap providers easily. You could avoid buying their bloated “client SDK” or “managed platform.” You would cut into their lock-in and cross-sell opportunities.
So they intentionally keep the API surface incomplete and browser-tied. The SSO market is rent-seeking and moat-driven. Consistency undermines their margins.
The answer, as always, is rent-seeking economics.
If there were a simple, universal API spec:
You could swap providers easily.
You could avoid buying their bloated “client SDK” or “managed platform.”
You would cut into their lock-in and cross-sell opportunities.
So they intentionally keep the API surface incomplete and browser-tied. The SSO market is rent-seeking and moat-driven. Consistency undermines their margins.