diff --git a/zgw_consumers/contrib/__init__.py b/zgw_consumers/contrib/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/zgw_consumers/contrib/setup_configuration/__init__.py b/zgw_consumers/contrib/setup_configuration/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/zgw_consumers/contrib/setup_configuration/models.py b/zgw_consumers/contrib/setup_configuration/models.py
new file mode 100644
index 0000000..d65e074
--- /dev/null
+++ b/zgw_consumers/contrib/setup_configuration/models.py
@@ -0,0 +1,36 @@
+from django_setup_configuration.models import ConfigurationModel, DjangoModelRef
+from pydantic import Field
+
+from zgw_consumers.models import Service
+
+
+class SingleServiceConfigurationModel(ConfigurationModel):
+    # TODO these should probably be defined in simple_certmanager and referred to?
+    # client_certificate: FilePath = DjangoModelRef(Service, "client_certificate")
+    # server_certificate: FilePath = DjangoModelRef(Service, "server_certificate")
+    api_connection_check_path = DjangoModelRef(
+        Service, "api_connection_check_path", default=""
+    )
+    client_id = DjangoModelRef(Service, "client_id", default="")
+    secret = DjangoModelRef(Service, "secret", default="")
+    header_key = DjangoModelRef(Service, "header_key", default="")
+    header_value = DjangoModelRef(Service, "header_value", default="")
+    nlx = DjangoModelRef(Service, "nlx", default="")
+    user_id = DjangoModelRef(Service, "user_id", default="")
+    user_representation = DjangoModelRef(Service, "user_representation", default="")
+    timeout: int | None = DjangoModelRef(Service, "timeout")
+
+    class Meta:
+        django_model_refs = {
+            Service: [
+                "slug",
+                "label",
+                "api_type",
+                "api_root",
+                "auth_type",
+            ]
+        }
+
+
+class ServicesConfigurationModel(ConfigurationModel):
+    services: list[SingleServiceConfigurationModel] = Field(default_factory=list)
diff --git a/zgw_consumers/contrib/setup_configuration/steps.py b/zgw_consumers/contrib/setup_configuration/steps.py
new file mode 100644
index 0000000..f5ad9b0
--- /dev/null
+++ b/zgw_consumers/contrib/setup_configuration/steps.py
@@ -0,0 +1,46 @@
+from django_setup_configuration.configuration import BaseConfigurationStep
+from django_setup_configuration.exceptions import SelfTestFailed
+from requests.exceptions import RequestException
+
+from zgw_consumers.client import build_client
+from zgw_consumers.models import Service
+
+from .models import ServicesConfigurationModel
+
+
+class ServiceConfigurationStep(BaseConfigurationStep[ServicesConfigurationModel]):
+    """
+    Configure admin login via OpenID Connect
+    """
+
+    verbose_name = "Configuration to connect with external services"
+    config_model = ServicesConfigurationModel
+    namespace = "ZGW_CONSUMERS"
+    enable_setting = "ZGW_CONSUMERS_CONFIG_ENABLE"
+
+    def is_configured(self, model) -> bool:
+        slugs = [config.slug for config in model.services]
+        return Service.objects.filter(slug__in=slugs).count() == len(slugs)
+
+    def execute(self, model):
+        for config in model.services:
+            Service.objects.update_or_create(
+                slug=config.slug,
+                defaults={k: v for k, v in config.dict().items() if k != "slug"},
+            )
+
+    def validate_result(self, model) -> None:
+        slugs = [config.slug for config in model.services]
+        exceptions = []
+        for service in Service.objects.filter(slug__in=slugs):
+            client = build_client(service)
+            try:
+                response = client.get("")
+                response.raise_for_status()
+            except RequestException as e:
+                exceptions.append(e)
+
+        if exceptions:
+            raise SelfTestFailed(
+                "non-success response from configured service(s)", exceptions
+            )