diff --git a/lib/code0/identities.rb b/lib/code0/identities.rb
index db3c65e..0fae0a1 100644
--- a/lib/code0/identities.rb
+++ b/lib/code0/identities.rb
@@ -18,5 +18,7 @@
 module Code0
   module Identities
     class Error < StandardError; end
+    class MissingConfigurationError < Error; end
+    class InvalidConfigurationError < Error; end
   end
 end
diff --git a/lib/code0/identities/identity_provider.rb b/lib/code0/identities/identity_provider.rb
index e55e4c3..e172355 100644
--- a/lib/code0/identities/identity_provider.rb
+++ b/lib/code0/identities/identity_provider.rb
@@ -24,11 +24,11 @@ def load_identity(provider_id, params)
           raise Error, "Provider with id '#{provider_id}' is not configured, did you forget to use add_provider"
         end
 
-        provider.load_identity(params)
+        provider.load_identity(**params)
       end
 
-      def [](provider_id)
-        providers[provider_id]
+      def self.for_type(provider_type)
+        Identities::Provider.const_get(provider_type.capitalize)
       end
     end
   end
diff --git a/lib/code0/identities/provider/base_oauth.rb b/lib/code0/identities/provider/base_oauth.rb
index d4a3824..609c480 100644
--- a/lib/code0/identities/provider/base_oauth.rb
+++ b/lib/code0/identities/provider/base_oauth.rb
@@ -10,7 +10,7 @@ def initialize(config_loader)
           @config_loader = config_loader
         end
 
-        def config_attributes
+        def validate_config!
           raise NotImplementedError
         end
 
diff --git a/lib/code0/identities/provider/discord.rb b/lib/code0/identities/provider/discord.rb
index 8f602c7..7f6a3fc 100644
--- a/lib/code0/identities/provider/discord.rb
+++ b/lib/code0/identities/provider/discord.rb
@@ -4,11 +4,14 @@ module Code0
   module Identities
     module Provider
       class Discord < BaseOauth
-        def config_attributes
-          {
-            required: %i[client_id client_secret redirect_uri],
-            optional: %i[provider_name]
-          }
+        def validate_config!
+          required_keys = %i[redirect_uri client_id client_secret]
+
+          missing_keys = required_keys - config.keys
+          invalid_keys = config.keys - required_keys - [:provider_name]
+
+          raise MissingConfigurationError, "Missing: #{missing_keys.inspect}" if missing_keys.any?
+          raise InvalidConfigurationError, "Invalid: #{invalid_keys.inspect}" if invalid_keys.any?
         end
 
         def token_url
diff --git a/lib/code0/identities/provider/github.rb b/lib/code0/identities/provider/github.rb
index 9768ee1..ce58b44 100644
--- a/lib/code0/identities/provider/github.rb
+++ b/lib/code0/identities/provider/github.rb
@@ -4,11 +4,14 @@ module Code0
   module Identities
     module Provider
       class Github < BaseOauth
-        def config_attributes
-          {
-            required: %i[client_id client_secret redirect_uri],
-            optional: %i[provider_name]
-          }
+        def validate_config!
+          required_keys = %i[redirect_uri client_id client_secret]
+
+          missing_keys = required_keys - config.keys
+          invalid_keys = config.keys - required_keys - [:provider_name]
+
+          raise MissingConfigurationError, "Missing: #{missing_keys.inspect}" if missing_keys.any?
+          raise InvalidConfigurationError, "Invalid: #{invalid_keys.inspect}" if invalid_keys.any?
         end
 
         def token_url
diff --git a/lib/code0/identities/provider/gitlab.rb b/lib/code0/identities/provider/gitlab.rb
index aae6100..40ffbca 100644
--- a/lib/code0/identities/provider/gitlab.rb
+++ b/lib/code0/identities/provider/gitlab.rb
@@ -4,11 +4,14 @@ module Code0
   module Identities
     module Provider
       class Gitlab < BaseOauth
-        def config_attributes
-          {
-            required: %i[base_url client_id client_secret redirect_uri],
-            optional: %i[provider_name]
-          }
+        def validate_config!
+          required_keys = %i[base_url redirect_uri client_id client_secret]
+
+          missing_keys = required_keys - config.keys
+          invalid_keys = config.keys - required_keys - [:provider_name]
+
+          raise MissingConfigurationError, "Missing: #{missing_keys.inspect}" if missing_keys.any?
+          raise InvalidConfigurationError, "Invalid: #{invalid_keys.inspect}" if invalid_keys.any?
         end
 
         def base_url
diff --git a/lib/code0/identities/provider/google.rb b/lib/code0/identities/provider/google.rb
index c9ad658..f4fc7f5 100644
--- a/lib/code0/identities/provider/google.rb
+++ b/lib/code0/identities/provider/google.rb
@@ -4,11 +4,14 @@ module Code0
   module Identities
     module Provider
       class Google < BaseOauth
-        def config_attributes
-          {
-            required: %i[client_id client_secret redirect_uri],
-            optional: %i[provider_name]
-          }
+        def validate_config!
+          required_keys = %i[redirect_uri client_id client_secret]
+
+          missing_keys = required_keys - config.keys
+          invalid_keys = config.keys - required_keys - [:provider_name]
+
+          raise MissingConfigurationError, "Missing: #{missing_keys.inspect}" if missing_keys.any?
+          raise InvalidConfigurationError, "Invalid: #{invalid_keys.inspect}" if invalid_keys.any?
         end
 
         def base_url
diff --git a/lib/code0/identities/provider/microsoft.rb b/lib/code0/identities/provider/microsoft.rb
index a84ba3a..db28433 100644
--- a/lib/code0/identities/provider/microsoft.rb
+++ b/lib/code0/identities/provider/microsoft.rb
@@ -4,11 +4,14 @@ module Code0
   module Identities
     module Provider
       class Microsoft < BaseOauth
-        def config_attributes
-          {
-            required: %i[client_id client_secret redirect_uri],
-            optional: %i[provider_name]
-          }
+        def validate_config!
+          required_keys = %i[redirect_uri client_id client_secret]
+
+          missing_keys = required_keys - config.keys
+          invalid_keys = config.keys - required_keys - [:provider_name]
+
+          raise MissingConfigurationError, "Missing: #{missing_keys.inspect}" if missing_keys.any?
+          raise InvalidConfigurationError, "Invalid: #{invalid_keys.inspect}" if invalid_keys.any?
         end
 
         def base_url
diff --git a/lib/code0/identities/provider/oidc.rb b/lib/code0/identities/provider/oidc.rb
index e4f2892..3ebf22d 100644
--- a/lib/code0/identities/provider/oidc.rb
+++ b/lib/code0/identities/provider/oidc.rb
@@ -4,11 +4,14 @@ module Code0
   module Identities
     module Provider
       class Oidc < BaseOauth
-        def config_attributes
-          {
-            required: %i[client_id client_secret redirect_uri token_url user_details_url authorization_url],
-            optional: %i[provider_name]
-          }
+        def validate_config!
+          required_keys = %i[client_id client_secret redirect_uri token_url user_details_url authorization_url]
+
+          missing_keys = required_keys - config.keys
+          invalid_keys = config.keys - required_keys - [:provider_name]
+
+          raise MissingConfigurationError, "Missing: #{missing_keys.inspect}" if missing_keys.any?
+          raise InvalidConfigurationError, "Invalid: #{invalid_keys.inspect}" if invalid_keys.any?
         end
 
         def token_url
diff --git a/lib/code0/identities/provider/saml.rb b/lib/code0/identities/provider/saml.rb
index dbd46be..0ccd77d 100644
--- a/lib/code0/identities/provider/saml.rb
+++ b/lib/code0/identities/provider/saml.rb
@@ -10,11 +10,14 @@ def initialize(config_loader)
           @config_loader = config_loader
         end
 
-        def config_attributes
-          {
-            required: %i[],
-            optional: %i[provider_name metadata_url settings response_settings attribute_statements]
-          }
+        def validate_config!
+          required_keys = config[:metadata_url].nil? ? %i[settings] : %i[metadata_url]
+
+          missing_keys = required_keys - config.keys
+          invalid_keys = config.keys - %i[provider_name metadata_url settings response_settings attribute_statements]
+
+          raise MissingConfigurationError, "Missing: #{missing_keys.inspect}" if missing_keys.any?
+          raise InvalidConfigurationError, "Invalid: #{invalid_keys.inspect}" if invalid_keys.any?
         end
 
         def authorization_url
diff --git a/sig/code0/identities.rbs b/sig/code0/identities.rbs
index 5f88fd5..c6aa45b 100644
--- a/sig/code0/identities.rbs
+++ b/sig/code0/identities.rbs
@@ -1,5 +1,7 @@
 module Code0
   module Identities
     class Error < StandardError end
+    class MissingConfigurationError < Error end
+    class InvalidConfigurationError < Error end
   end
 end
diff --git a/sig/code0/identities/identity_provider.rbs b/sig/code0/identities/identity_provider.rbs
index 12b4b77..5dad2e7 100644
--- a/sig/code0/identities/identity_provider.rbs
+++ b/sig/code0/identities/identity_provider.rbs
@@ -3,12 +3,12 @@
 module Code0
   module Identities
     class IdentityProvider
+      def self.for_type: -> Class
+
       attr_reader providers: Hash[Symbol, Provider::BaseOauth]
 
       def initialize: () -> void
 
-      def []: (Symbol) -> Provider::BaseOauth
-
       def add_provider: (provider_type: Symbol, config: Proc | Hash[Symbol, any]) -> void
 
       def add_named_provider: (provider_id: Symbol, provider_type: Symbol, config: Proc | Hash[Symbol, any]) -> void
diff --git a/sig/code0/identities/provider/base_oauth.rbs b/sig/code0/identities/provider/base_oauth.rbs
index b2b9d45..f21dbf6 100644
--- a/sig/code0/identities/provider/base_oauth.rbs
+++ b/sig/code0/identities/provider/base_oauth.rbs
@@ -8,7 +8,7 @@ module Code0
 
         def authorization_url: () -> String
 
-        def config_attributes: -> { optional: Array[Symbol], required: Array[Symbol] }
+        def validate_config!: -> void
 
         def token_url: () -> String
 
diff --git a/sig/code0/identities/provider/saml.rbs b/sig/code0/identities/provider/saml.rbs
index fef3755..e47736d 100644
--- a/sig/code0/identities/provider/saml.rbs
+++ b/sig/code0/identities/provider/saml.rbs
@@ -4,7 +4,7 @@ module Code0
       class Saml
         def authorization_url: () -> String
 
-        def config_attributes: -> { optional: Array[Symbol], required: Array[Symbol] }
+        def validate_config!: -> void
 
         def load_identity: (Hash[Symbol, any]) -> Identity
       end