---
title: "IDP Token Enrichment"
slug: "idp-token-enrichment"
updated: 2026-08-23T16:11:39Z
published: 2026-08-23T16:11:39Z
canonical: "docs.plainid.io/idp-token-enrichment"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.plainid.io/llms.txt
> Use this file to discover all available pages before exploring further.

# IDP Token Enrichment

The PlainID IDP Token Enrichment Service integrates with Identity Providers (IDPs) to dynamically enrich users’ Authorizations. During authentication, entitlements calculated by PlainID Policies are translated into claims and included in the IDP-generated JWT, which is then used by Applications.

This pattern allows seamless, session-based access control without requiring the user or Application to interact directly with the PlainID platform. It supports advanced claim enrichment from multiple data sources and adapts to vendor-specific IDP configurations.

## HTTPS

The IDP webhook receives identity events from your IDP and forwards them to the Agent. Enabling HTTPS puts native TLS on that connection to the Agent, so identity data moving through your PAA is encrypted end to end.

- **Kubernetes:** set `idpWebhook.ssl.enabled: true` in your Helm values.
- **ECS:** set `enable_https = true` in your `terraform.tfvars`, the same pack-wide flag you use for the rest of your PAA.

See [Enabling HTTPS for PAA Services](/v1/docs/enabling-https-for-paa-services) for how certificates are generated or supplied, and what this setting does and doesn't cover.

---

For detailed deployment and configuration guidance, see the [IDP Token Enrichment article](/docs/managing-the-idp-token-enrichment-service).