diff --git a/pkg/config/auth.go b/pkg/config/auth.go
index 2341b9b4bf..6c14cf649b 100644
--- a/pkg/config/auth.go
+++ b/pkg/config/auth.go
@@ -601,107 +601,125 @@ func (e external) toAuthConfigBody(body *v1API.UpdateAuthConfigBody) {
 	if len(e) == 0 {
 		return
 	}
-	var p *provider
 	// Ignore configs of disabled providers because their envs are not loaded
-	p = cast.Ptr(e["apple"])
-	if body.ExternalAppleEnabled = &p.Enabled; *body.ExternalAppleEnabled {
-		body.ExternalAppleClientId = &p.ClientId
-		body.ExternalAppleSecret = &p.Secret
-	}
-	p = cast.Ptr(e["azure"])
-	if body.ExternalAzureEnabled = &p.Enabled; *body.ExternalAzureEnabled {
-		body.ExternalAzureClientId = &p.ClientId
-		body.ExternalAzureSecret = &p.Secret
-		body.ExternalAzureUrl = &p.Url
-	}
-	p = cast.Ptr(e["bitbucket"])
-	if body.ExternalBitbucketEnabled = &p.Enabled; *body.ExternalBitbucketEnabled {
-		body.ExternalBitbucketClientId = &p.ClientId
-		body.ExternalBitbucketSecret = &p.Secret
-	}
-	p = cast.Ptr(e["discord"])
-	if body.ExternalDiscordEnabled = &p.Enabled; *body.ExternalDiscordEnabled {
-		body.ExternalDiscordClientId = &p.ClientId
-		body.ExternalDiscordSecret = &p.Secret
-	}
-	p = cast.Ptr(e["facebook"])
-	if body.ExternalFacebookEnabled = &p.Enabled; *body.ExternalFacebookEnabled {
-		body.ExternalFacebookClientId = &p.ClientId
-		body.ExternalFacebookSecret = &p.Secret
-	}
-	p = cast.Ptr(e["figma"])
-	if body.ExternalFigmaEnabled = &p.Enabled; *body.ExternalFigmaEnabled {
-		body.ExternalFigmaClientId = &p.ClientId
-		body.ExternalFigmaSecret = &p.Secret
-	}
-	p = cast.Ptr(e["github"])
-	if body.ExternalGithubEnabled = &p.Enabled; *body.ExternalGithubEnabled {
-		body.ExternalGithubClientId = &p.ClientId
-		body.ExternalGithubSecret = &p.Secret
-	}
-	p = cast.Ptr(e["gitlab"])
-	if body.ExternalGitlabEnabled = &p.Enabled; *body.ExternalGitlabEnabled {
-		body.ExternalGitlabClientId = &p.ClientId
-		body.ExternalGitlabSecret = &p.Secret
-		body.ExternalGitlabUrl = &p.Url
-	}
-	p = cast.Ptr(e["google"])
-	if body.ExternalGoogleEnabled = &p.Enabled; *body.ExternalGoogleEnabled {
-		body.ExternalGoogleClientId = &p.ClientId
-		body.ExternalGoogleSecret = &p.Secret
-		body.ExternalGoogleSkipNonceCheck = &p.SkipNonceCheck
-	}
-	p = cast.Ptr(e["kakao"])
-	if body.ExternalKakaoEnabled = &p.Enabled; *body.ExternalKakaoEnabled {
-		body.ExternalKakaoClientId = &p.ClientId
-		body.ExternalKakaoSecret = &p.Secret
-	}
-	p = cast.Ptr(e["keycloak"])
-	if body.ExternalKeycloakEnabled = &p.Enabled; *body.ExternalKeycloakEnabled {
-		body.ExternalKeycloakClientId = &p.ClientId
-		body.ExternalKeycloakSecret = &p.Secret
-		body.ExternalKeycloakUrl = &p.Url
-	}
-	p = cast.Ptr(e["linkedin_oidc"])
-	if body.ExternalLinkedinOidcEnabled = &p.Enabled; *body.ExternalLinkedinOidcEnabled {
-		body.ExternalLinkedinOidcClientId = &p.ClientId
-		body.ExternalLinkedinOidcSecret = &p.Secret
-	}
-	p = cast.Ptr(e["notion"])
-	if body.ExternalNotionEnabled = &p.Enabled; *body.ExternalNotionEnabled {
-		body.ExternalNotionClientId = &p.ClientId
-		body.ExternalNotionSecret = &p.Secret
-	}
-	p = cast.Ptr(e["slack_oidc"])
-	if body.ExternalSlackOidcEnabled = &p.Enabled; *body.ExternalSlackOidcEnabled {
-		body.ExternalSlackOidcClientId = &p.ClientId
-		body.ExternalSlackOidcSecret = &p.Secret
-	}
-	p = cast.Ptr(e["spotify"])
-	if body.ExternalSpotifyEnabled = &p.Enabled; *body.ExternalSpotifyEnabled {
-		body.ExternalSpotifyClientId = &p.ClientId
-		body.ExternalSpotifySecret = &p.Secret
-	}
-	p = cast.Ptr(e["twitch"])
-	if body.ExternalTwitchEnabled = &p.Enabled; *body.ExternalTwitchEnabled {
-		body.ExternalTwitchClientId = &p.ClientId
-		body.ExternalTwitchSecret = &p.Secret
-	}
-	p = cast.Ptr(e["twitter"])
-	if body.ExternalTwitterEnabled = &p.Enabled; *body.ExternalTwitterEnabled {
-		body.ExternalTwitterClientId = &p.ClientId
-		body.ExternalTwitterSecret = &p.Secret
-	}
-	p = cast.Ptr(e["workos"])
-	if body.ExternalWorkosEnabled = &p.Enabled; *body.ExternalWorkosEnabled {
-		body.ExternalWorkosClientId = &p.ClientId
-		body.ExternalWorkosSecret = &p.Secret
-		body.ExternalWorkosUrl = &p.Url
-	}
-	p = cast.Ptr(e["zoom"])
-	if body.ExternalZoomEnabled = &p.Enabled; *body.ExternalZoomEnabled {
-		body.ExternalZoomClientId = &p.ClientId
-		body.ExternalZoomSecret = &p.Secret
+	if p, ok := e["apple"]; ok {
+		if body.ExternalAppleEnabled = &p.Enabled; *body.ExternalAppleEnabled {
+			body.ExternalAppleClientId = &p.ClientId
+			body.ExternalAppleSecret = &p.Secret
+		}
+	}
+	if p, ok := e["azure"]; ok {
+		if body.ExternalAzureEnabled = &p.Enabled; *body.ExternalAzureEnabled {
+			body.ExternalAzureClientId = &p.ClientId
+			body.ExternalAzureSecret = &p.Secret
+			body.ExternalAzureUrl = &p.Url
+		}
+	}
+	if p, ok := e["bitbucket"]; ok {
+		if body.ExternalBitbucketEnabled = &p.Enabled; *body.ExternalBitbucketEnabled {
+			body.ExternalBitbucketClientId = &p.ClientId
+			body.ExternalBitbucketSecret = &p.Secret
+		}
+	}
+	if p, ok := e["discord"]; ok {
+		if body.ExternalDiscordEnabled = &p.Enabled; *body.ExternalDiscordEnabled {
+			body.ExternalDiscordClientId = &p.ClientId
+			body.ExternalDiscordSecret = &p.Secret
+		}
+	}
+	if p, ok := e["facebook"]; ok {
+		if body.ExternalFacebookEnabled = &p.Enabled; *body.ExternalFacebookEnabled {
+			body.ExternalFacebookClientId = &p.ClientId
+			body.ExternalFacebookSecret = &p.Secret
+		}
+	}
+	if p, ok := e["figma"]; ok {
+		if body.ExternalFigmaEnabled = &p.Enabled; *body.ExternalFigmaEnabled {
+			body.ExternalFigmaClientId = &p.ClientId
+			body.ExternalFigmaSecret = &p.Secret
+		}
+	}
+	if p, ok := e["github"]; ok {
+		if body.ExternalGithubEnabled = &p.Enabled; *body.ExternalGithubEnabled {
+			body.ExternalGithubClientId = &p.ClientId
+			body.ExternalGithubSecret = &p.Secret
+		}
+	}
+	if p, ok := e["gitlab"]; ok {
+		if body.ExternalGitlabEnabled = &p.Enabled; *body.ExternalGitlabEnabled {
+			body.ExternalGitlabClientId = &p.ClientId
+			body.ExternalGitlabSecret = &p.Secret
+			body.ExternalGitlabUrl = &p.Url
+		}
+	}
+	if p, ok := e["google"]; ok {
+		if body.ExternalGoogleEnabled = &p.Enabled; *body.ExternalGoogleEnabled {
+			body.ExternalGoogleClientId = &p.ClientId
+			body.ExternalGoogleSecret = &p.Secret
+			body.ExternalGoogleSkipNonceCheck = &p.SkipNonceCheck
+		}
+	}
+	if p, ok := e["kakao"]; ok {
+		if body.ExternalKakaoEnabled = &p.Enabled; *body.ExternalKakaoEnabled {
+			body.ExternalKakaoClientId = &p.ClientId
+			body.ExternalKakaoSecret = &p.Secret
+		}
+	}
+	if p, ok := e["keycloak"]; ok {
+		if body.ExternalKeycloakEnabled = &p.Enabled; *body.ExternalKeycloakEnabled {
+			body.ExternalKeycloakClientId = &p.ClientId
+			body.ExternalKeycloakSecret = &p.Secret
+			body.ExternalKeycloakUrl = &p.Url
+		}
+	}
+	if p, ok := e["linkedin_oidc"]; ok {
+		if body.ExternalLinkedinOidcEnabled = &p.Enabled; *body.ExternalLinkedinOidcEnabled {
+			body.ExternalLinkedinOidcClientId = &p.ClientId
+			body.ExternalLinkedinOidcSecret = &p.Secret
+		}
+	}
+	if p, ok := e["notion"]; ok {
+		if body.ExternalNotionEnabled = &p.Enabled; *body.ExternalNotionEnabled {
+			body.ExternalNotionClientId = &p.ClientId
+			body.ExternalNotionSecret = &p.Secret
+		}
+	}
+	if p, ok := e["slack_oidc"]; ok {
+		if body.ExternalSlackOidcEnabled = &p.Enabled; *body.ExternalSlackOidcEnabled {
+			body.ExternalSlackOidcClientId = &p.ClientId
+			body.ExternalSlackOidcSecret = &p.Secret
+		}
+	}
+	if p, ok := e["spotify"]; ok {
+		if body.ExternalSpotifyEnabled = &p.Enabled; *body.ExternalSpotifyEnabled {
+			body.ExternalSpotifyClientId = &p.ClientId
+			body.ExternalSpotifySecret = &p.Secret
+		}
+	}
+	if p, ok := e["twitch"]; ok {
+		if body.ExternalTwitchEnabled = &p.Enabled; *body.ExternalTwitchEnabled {
+			body.ExternalTwitchClientId = &p.ClientId
+			body.ExternalTwitchSecret = &p.Secret
+		}
+	}
+	if p, ok := e["twitter"]; ok {
+		if body.ExternalTwitterEnabled = &p.Enabled; *body.ExternalTwitterEnabled {
+			body.ExternalTwitterClientId = &p.ClientId
+			body.ExternalTwitterSecret = &p.Secret
+		}
+	}
+	if p, ok := e["workos"]; ok {
+		if body.ExternalWorkosEnabled = &p.Enabled; *body.ExternalWorkosEnabled {
+			body.ExternalWorkosClientId = &p.ClientId
+			body.ExternalWorkosSecret = &p.Secret
+			body.ExternalWorkosUrl = &p.Url
+		}
+	}
+	if p, ok := e["zoom"]; ok {
+		if body.ExternalZoomEnabled = &p.Enabled; *body.ExternalZoomEnabled {
+			body.ExternalZoomClientId = &p.ClientId
+			body.ExternalZoomSecret = &p.Secret
+		}
 	}
 }
 
@@ -709,151 +727,188 @@ func (e external) fromAuthConfig(remoteConfig v1API.AuthConfigResponse) {
 	if len(e) == 0 {
 		return
 	}
-	var p provider
 	// Ignore configs of disabled providers because their envs are not loaded
-	if p = e["apple"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalAppleClientId, "")
-		if ids := cast.Val(remoteConfig.ExternalAppleAdditionalClientIds, ""); len(ids) > 0 {
-			p.ClientId += "," + ids
+	if p, ok := e["apple"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalAppleClientId, "")
+			if ids := cast.Val(remoteConfig.ExternalAppleAdditionalClientIds, ""); len(ids) > 0 {
+				p.ClientId += "," + ids
+			}
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalAppleSecret, "")
 		}
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalAppleSecret, "")
-	}
-	p.Enabled = cast.Val(remoteConfig.ExternalAppleEnabled, false)
-	e["apple"] = p
-
-	if p = e["azure"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalAzureClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalAzureSecret, "")
-		p.Url = cast.Val(remoteConfig.ExternalAzureUrl, "")
+		p.Enabled = cast.Val(remoteConfig.ExternalAppleEnabled, false)
+		e["apple"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalAzureEnabled, false)
-	e["azure"] = p
 
-	if p = e["bitbucket"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalBitbucketClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalBitbucketSecret, "")
+	if p, ok := e["azure"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalAzureClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalAzureSecret, "")
+			p.Url = cast.Val(remoteConfig.ExternalAzureUrl, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalAzureEnabled, false)
+		e["azure"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalBitbucketEnabled, false)
-	e["bitbucket"] = p
 
-	if p = e["discord"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalDiscordClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalDiscordSecret, "")
+	if p, ok := e["bitbucket"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalBitbucketClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalBitbucketSecret, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalBitbucketEnabled, false)
+		e["bitbucket"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalDiscordEnabled, false)
-	e["discord"] = p
 
-	if p = e["facebook"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalFacebookClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalFacebookSecret, "")
+	if p, ok := e["discord"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalDiscordClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalDiscordSecret, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalDiscordEnabled, false)
+		e["discord"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalFacebookEnabled, false)
-	e["facebook"] = p
 
-	if p = e["figma"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalFigmaClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalFigmaSecret, "")
+	if p, ok := e["facebook"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalFacebookClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalFacebookSecret, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalFacebookEnabled, false)
+		e["facebook"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalFigmaEnabled, false)
-	e["figma"] = p
 
-	if p = e["github"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalGithubClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalGithubSecret, "")
+	if p, ok := e["figma"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalFigmaClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalFigmaSecret, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalFigmaEnabled, false)
+		e["figma"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalGithubEnabled, false)
-	e["github"] = p
 
-	if p = e["gitlab"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalGitlabClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalGitlabSecret, "")
-		p.Url = cast.Val(remoteConfig.ExternalGitlabUrl, "")
+	if p, ok := e["github"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalGithubClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalGithubSecret, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalGithubEnabled, false)
+		e["github"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalGitlabEnabled, false)
-	e["gitlab"] = p
 
-	if p = e["google"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalGoogleClientId, "")
-		if ids := cast.Val(remoteConfig.ExternalGoogleAdditionalClientIds, ""); len(ids) > 0 {
-			p.ClientId += "," + ids
+	if p, ok := e["gitlab"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalGitlabClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalGitlabSecret, "")
+			p.Url = cast.Val(remoteConfig.ExternalGitlabUrl, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalGitlabEnabled, false)
+		e["gitlab"] = p
+	}
+
+	if p, ok := e["google"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalGoogleClientId, "")
+			if ids := cast.Val(remoteConfig.ExternalGoogleAdditionalClientIds, ""); len(ids) > 0 {
+				p.ClientId += "," + ids
+			}
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalGoogleSecret, "")
+			p.SkipNonceCheck = cast.Val(remoteConfig.ExternalGoogleSkipNonceCheck, false)
 		}
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalGoogleSecret, "")
-		p.SkipNonceCheck = cast.Val(remoteConfig.ExternalGoogleSkipNonceCheck, false)
+		p.Enabled = cast.Val(remoteConfig.ExternalGoogleEnabled, false)
+		e["google"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalGoogleEnabled, false)
-	e["google"] = p
 
-	if p = e["kakao"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalKakaoClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalKakaoSecret, "")
+	if p, ok := e["kakao"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalKakaoClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalKakaoSecret, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalKakaoEnabled, false)
+		e["kakao"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalKakaoEnabled, false)
-	e["kakao"] = p
 
-	if p = e["keycloak"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalKeycloakClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalKeycloakSecret, "")
-		p.Url = cast.Val(remoteConfig.ExternalKeycloakUrl, "")
+	if p, ok := e["keycloak"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalKeycloakClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalKeycloakSecret, "")
+			p.Url = cast.Val(remoteConfig.ExternalKeycloakUrl, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalKeycloakEnabled, false)
+		e["keycloak"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalKeycloakEnabled, false)
-	e["keycloak"] = p
 
-	if p = e["linkedin_oidc"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalLinkedinOidcClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalLinkedinOidcSecret, "")
+	if p, ok := e["linkedin_oidc"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalLinkedinOidcClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalLinkedinOidcSecret, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalLinkedinOidcEnabled, false)
+		e["linkedin_oidc"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalLinkedinOidcEnabled, false)
-	e["linkedin_oidc"] = p
 
-	if p = e["notion"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalNotionClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalNotionSecret, "")
+	if p, ok := e["notion"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalNotionClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalNotionSecret, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalNotionEnabled, false)
+		e["notion"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalNotionEnabled, false)
-	e["notion"] = p
 
-	if p = e["slack_oidc"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalSlackOidcClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalSlackOidcSecret, "")
+	if p, ok := e["slack_oidc"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalSlackOidcClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalSlackOidcSecret, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalSlackOidcEnabled, false)
+		e["slack_oidc"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalSlackOidcEnabled, false)
-	e["slack_oidc"] = p
 
-	if p = e["spotify"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalSpotifyClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalSpotifySecret, "")
+	if p, ok := e["spotify"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalSpotifyClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalSpotifySecret, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalSpotifyEnabled, false)
+		e["spotify"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalSpotifyEnabled, false)
-	e["spotify"] = p
 
-	if p = e["twitch"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalTwitchClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalTwitchSecret, "")
+	if p, ok := e["twitch"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalTwitchClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalTwitchSecret, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalTwitchEnabled, false)
+		e["twitch"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalTwitchEnabled, false)
-	e["twitch"] = p
 
-	if p = e["twitter"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalTwitterClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalTwitterSecret, "")
+	if p, ok := e["twitter"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalTwitterClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalTwitterSecret, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalTwitterEnabled, false)
+		e["twitter"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalTwitterEnabled, false)
-	e["twitter"] = p
 
-	if p = e["workos"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalWorkosClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalWorkosSecret, "")
-		p.Url = cast.Val(remoteConfig.ExternalWorkosUrl, "")
+	if p, ok := e["workos"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalWorkosClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalWorkosSecret, "")
+			p.Url = cast.Val(remoteConfig.ExternalWorkosUrl, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalWorkosEnabled, false)
+		e["workos"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalWorkosEnabled, false)
-	e["workos"] = p
 
-	if p = e["zoom"]; p.Enabled {
-		p.ClientId = cast.Val(remoteConfig.ExternalZoomClientId, "")
-		p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalZoomSecret, "")
+	if p, ok := e["zoom"]; ok {
+		if p.Enabled {
+			p.ClientId = cast.Val(remoteConfig.ExternalZoomClientId, "")
+			p.Secret = hashPrefix + cast.Val(remoteConfig.ExternalZoomSecret, "")
+		}
+		p.Enabled = cast.Val(remoteConfig.ExternalZoomEnabled, false)
+		e["zoom"] = p
 	}
-	p.Enabled = cast.Val(remoteConfig.ExternalZoomEnabled, false)
-	e["zoom"] = p
 }
 
 func (a *auth) DiffWithRemote(projectRef string, remoteConfig v1API.AuthConfigResponse) ([]byte, error) {
diff --git a/pkg/config/auth_test.go b/pkg/config/auth_test.go
index aa35bcf9ff..404f1cbb65 100644
--- a/pkg/config/auth_test.go
+++ b/pkg/config/auth_test.go
@@ -835,15 +835,24 @@ func TestExternalDiff(t *testing.T) {
 				ClientId: "test-client-1,test-client-2",
 				Secret:   "test-secret",
 			},
-			"azure":         {},
-			"bitbucket":     {},
-			"discord":       {},
-			"facebook":      {},
-			"figma":         {},
-			"github":        {},
-			"gitlab":        {},
-			"google":        {},
-			"kakao":         {},
+			"azure": {
+				Enabled:  true,
+				ClientId: "test-client-1",
+				Secret:   "test-secret",
+			},
+			"bitbucket": {},
+			"discord":   {},
+			"facebook":  {},
+			"figma":     {},
+			"github":    {},
+			"gitlab":    {},
+			"google": {
+				Enabled:        false,
+				ClientId:       "test-client-2",
+				Secret:         "env(test_secret)",
+				SkipNonceCheck: false,
+			},
+			// "kakao":         {},
 			"keycloak":      {},
 			"linkedin_oidc": {},
 			"notion":        {},
@@ -865,6 +874,9 @@ func TestExternalDiff(t *testing.T) {
 			ExternalGoogleEnabled:             cast.Ptr(true),
 			ExternalGoogleSecret:              cast.Ptr("b613679a0814d9ec772f95d778c35fc5ff1697c493715653c6c712144292c5ad"),
 			ExternalGoogleSkipNonceCheck:      cast.Ptr(true),
+			ExternalKakaoClientId:             cast.Ptr("test-client-2"),
+			ExternalKakaoEnabled:              cast.Ptr(true),
+			ExternalKakaoSecret:               cast.Ptr("b613679a0814d9ec772f95d778c35fc5ff1697c493715653c6c712144292c5ad"),
 		})
 		// Check error
 		assert.NoError(t, err)
diff --git a/pkg/config/config.go b/pkg/config/config.go
index fcc2d3710f..6b8306ba5b 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -306,29 +306,7 @@ func NewConfig(editors ...ConfigEditor) config {
 			Sms: sms{
 				TestOTP: map[string]string{},
 			},
-			External: map[string]provider{
-				"apple":         {},
-				"azure":         {},
-				"bitbucket":     {},
-				"discord":       {},
-				"facebook":      {},
-				"figma":         {},
-				"github":        {},
-				"gitlab":        {},
-				"google":        {},
-				"kakao":         {},
-				"keycloak":      {},
-				"linkedin":      {}, // TODO: remove this field in v2
-				"linkedin_oidc": {},
-				"notion":        {},
-				"twitch":        {},
-				"twitter":       {},
-				"slack":         {}, // TODO: remove this field in v2
-				"slack_oidc":    {},
-				"spotify":       {},
-				"workos":        {},
-				"zoom":          {},
-			},
+			External:  map[string]provider{},
 			JwtSecret: defaultJwtSecret,
 		},
 		Inbucket: inbucket{
diff --git a/pkg/config/testdata/TestExternalDiff/local_enabled_and_disabled.diff b/pkg/config/testdata/TestExternalDiff/local_enabled_and_disabled.diff
index 234e422f45..37ab653dd5 100644
--- a/pkg/config/testdata/TestExternalDiff/local_enabled_and_disabled.diff
+++ b/pkg/config/testdata/TestExternalDiff/local_enabled_and_disabled.diff
@@ -10,12 +10,25 @@ diff remote[auth] local[auth]
  client_id = "test-client-1,test-client-2"
  secret = "hash:ce62bb9bcced294fd4afe668f8ab3b50a89cf433093c526fffa3d0e46bf55252"
  url = ""
+@@ -98,9 +98,9 @@
+ redirect_uri = ""
+ skip_nonce_check = false
+ [external.azure]
+-enabled = false
+-client_id = ""
+-secret = "hash:"
++enabled = true
++client_id = "test-client-1"
++secret = "hash:ce62bb9bcced294fd4afe668f8ab3b50a89cf433093c526fffa3d0e46bf55252"
+ url = ""
+ redirect_uri = ""
+ skip_nonce_check = false
 @@ -147,7 +147,7 @@
  redirect_uri = ""
  skip_nonce_check = false
  [external.google]
 -enabled = true
 +enabled = false
- client_id = ""
- secret = ""
+ client_id = "test-client-2"
+ secret = "env(test_secret)"
  url = ""