Single sign-on (OIDC)
Let your team sign in through your own identity provider (Keycloak, Microsoft Entra ID, Google Workspace, Okta, Authentik) with automatic account creation and optional SSO-only enforcement.
Uptimeify supports single sign-on over OpenID Connect (OIDC) per organization. Team members sign in through your identity provider (IdP); customer logins are not affected. SAML is planned.
Requirements
- You are an admin of your Uptimeify organization.
- You can create an OIDC client (confidential, authorization code flow with PKCE) in your IdP.
- You can add a DNS TXT record for the email domain your team uses.
1. Create the client in your IdP
Create a confidential OIDC client and allow this redirect URI (shown in Uptimeify under Settings → Security → Single sign-on after the first save):
https://uptimeify.io/api/auth/sso/callback/org-<your-organization-id>Scopes: openid email profile. The client secret stays with Uptimeify encrypted and is never shown again.
2. Set up SSO in Uptimeify
Go to Settings → Security → Single sign-on (OIDC) and fill in:
| Field | Meaning |
|---|---|
| Issuer URL | The issuer of your IdP, for example https://login.microsoftonline.com/TENANT-ID/v2.0. Uptimeify loads /.well-known/openid-configuration from it when you save. |
| Client ID, client secret | From step 1. Leave the secret empty later to keep the stored one. |
| Email domain | The domain of your team's addresses, for example example.com. One domain belongs to one organization only. |
| Role for new users | Read only, Editor, Responder or Admin. People who sign in via SSO for the first time get an account in your organization with this role. |
3. Verify the domain
Uptimeify shows a TXT record. Create it at your DNS provider, then click Check:
_uptimeify-sso.example.com TXT "uptimeify-sso=<token>"SSO only works once the domain is verified. Changing the domain or the issuer requires verifying again.
4. Sign in
On the login page, click Sign in with SSO, enter your work email and you are redirected to your IdP. Existing accounts of your organization with the same email are reused; addresses that belong to another Uptimeify organization are rejected.
SSO only
After the domain is verified and one SSO login succeeded, you can switch on SSO only. Team members can then no longer sign in with a password. Two exceptions:
- Admins keep password and 2FA as emergency access, in case your IdP is down or misconfigured.
- Customer logins (users with access to individual customers) are not affected.
Provider examples
Keycloak: Client type OpenID Connect, client authentication on, standard flow on, PKCE method S256. Issuer: https://keycloak.example.com/realms/REALM. Make sure users have a verified email.
Microsoft Entra ID: App registration, platform "Web" with the redirect URI above, create a client secret. Issuer: https://login.microsoftonline.com/TENANT-ID/v2.0.
Google Workspace: Google Cloud console, OAuth client ID of type "Web application" with the redirect URI above. Issuer: https://accounts.google.com.
Error messages
| Message | Meaning |
|---|---|
| SSO is not set up for this domain | No verified SSO for the email domain. Sign in with your password. |
| Address outside the verified domain | The IdP returned an email that does not end on the verified domain. |
| Address marked as unverified | The IdP sent email_verified: false. |
| Address belongs to a different organization | The email already has an account in another Uptimeify organization. |
| Account is deactivated | An admin deactivated this account in Uptimeify. |
| Your organization requires single sign-on | SSO only is on; use Sign in with SSO. |