diff --git a/molecule/keycloak_modules/verify.yml b/molecule/keycloak_modules/verify.yml
index b08f1a8..4d799de 100644
--- a/molecule/keycloak_modules/verify.yml
+++ b/molecule/keycloak_modules/verify.yml
@@ -253,6 +253,50 @@
               clientId: molecule-idp-client
             state: present
 
+        - name: keycloak_identity_provider — set hide_on_login via top-level param
+          middleware_automation.keycloak.keycloak_identity_provider:
+            realm: "{{ target_realm }}"
+            alias: "{{ idp }}"
+            hide_on_login: true
+            state: present
+          register: idp_hide_on_login_result
+
+        - name: Assert hide_on_login is set correctly in end_state
+          ansible.builtin.assert:
+            that:
+              - idp_hide_on_login_result is changed
+              - idp_hide_on_login_result.end_state.hideOnLogin == true
+              - "'hide_on_login' not in (idp_hide_on_login_result.end_state.config | default({}))"
+
+        - name: keycloak_identity_provider — set hide_on_login idempotency check
+          middleware_automation.keycloak.keycloak_identity_provider:
+            realm: "{{ target_realm }}"
+            alias: "{{ idp }}"
+            hide_on_login: true
+            state: present
+          register: idp_hide_on_login_idempotent_result
+
+        - name: Assert hide_on_login idempotency (no change)
+          ansible.builtin.assert:
+            that:
+              - idp_hide_on_login_idempotent_result is not changed
+              - idp_hide_on_login_idempotent_result.end_state.hideOnLogin == true
+
+        - name: keycloak_identity_provider — set hide_on_login via legacy config key (backward compat)
+          middleware_automation.keycloak.keycloak_identity_provider:
+            realm: "{{ target_realm }}"
+            alias: "{{ idp }}"
+            hide_on_login: false
+            state: present
+          register: idp_hide_on_login_off_result
+
+        - name: Assert hide_on_login can be toggled off via top-level param
+          ansible.builtin.assert:
+            that:
+              - idp_hide_on_login_off_result is changed
+              - idp_hide_on_login_off_result.end_state.hideOnLogin == false
+              - "'hide_on_login_page' not in (idp_hide_on_login_off_result.end_state.config | default({}))"
+
         - name: keycloak_clienttemplate — create client template
           middleware_automation.keycloak.keycloak_clienttemplate:
             realm: "{{ target_realm }}"
diff --git a/plugins/modules/keycloak_identity_provider.py b/plugins/modules/keycloak_identity_provider.py
index 96eeb10..4f199dd 100644
--- a/plugins/modules/keycloak_identity_provider.py
+++ b/plugins/modules/keycloak_identity_provider.py
@@ -115,6 +115,15 @@ options:
       - authenticateByDefault
     type: bool
 
+  hide_on_login:
+    description:
+      - If hidden, login with this provider is possible only if requested explicitly, for example using the C(kc_idp_hint)
+        parameter.
+    aliases:
+      - hideOnLogin
+      - hide_on_login_page
+    type: bool
+
   provider_id:
     description:
       - Protocol used by this provider (supported values are V(oidc) or V(saml)).
@@ -129,14 +138,6 @@ options:
         identity provider configuration through check-mode in the RV(existing) field.
     type: dict
     suboptions:
-      hide_on_login_page:
-        description:
-          - If hidden, login with this provider is possible only if requested explicitly, for example using the C(kc_idp_hint)
-            parameter.
-        aliases:
-          - hideOnLoginPage
-        type: bool
-
       gui_order:
         description:
           - Number defining order of the provider in GUI (for example, on Login page).
@@ -569,6 +570,7 @@ def main():
         alias=dict(type="str", required=True),
         add_read_token_role_on_create=dict(type="bool", aliases=["addReadTokenRoleOnCreate"]),
         authenticate_by_default=dict(type="bool", aliases=["authenticateByDefault"]),
+        hide_on_login=dict(type="bool", aliases=["hideOnLogin", "hide_on_login_page"]),
         config=dict(type="dict"),
         display_name=dict(type="str", aliases=["displayName"]),
         enabled=dict(type="bool"),
@@ -608,6 +610,20 @@ def main():
     state = module.params.get("state")
     config = module.params.get("config")
 
+    if config is not None:
+        for legacy_key in ("hide_on_login_page", "hideOnLoginPage"):
+            if legacy_key in config:
+                module.deprecate(
+                    f"Passing '{legacy_key}' inside 'config' is deprecated. "
+                    "Use the top-level 'hide_on_login' parameter instead.",
+                    version="4.0.0",
+                    collection_name="middleware_automation.keycloak",
+                )
+                if module.params.get("hide_on_login") is None:
+                    module.params["hide_on_login"] = config.pop(legacy_key)
+                else:
+                    config.pop(legacy_key)
+
     fetch_identity_provider_wellknown_config(kc, config)
 
     # Filter and map the parameters names that apply to the identity provider.