Single sign-on

Let a client's staff sign in with their company account (Google Workspace, Microsoft Entra ID, Okta, Auth0) instead of a password.

1. 1
   In your identity provider, create an OpenID Connect (OIDC) web app.
2. 2
   Register the redirect URL shown in Settings › Single sign-on.
3. 3
   Copy its issuer URL, client ID and client secret into Settings, with the email domain it covers.
4. 4
   Optionally require it, so people at that domain can't use a password.

• People sign in from Sign in with SSO on the sign-in page, using their work email.
• Someone from the domain signing in for the first time gets an account as a member; an admin can make them an admin.
• Two-step sign-in is left to the identity provider for single sign-on.