---
title: "Single sign-on (OIDC)"
description: "Let your team sign in through your own identity provider (Keycloak, Microsoft Entra ID, Google Workspace, Okta, Authentik) with automatic account creation and optional SSO-only enforcement."
---

Uptimeify supports single sign-on over **OpenID Connect (OIDC)** per organization. Team members sign in through your identity provider (IdP); customer logins are not affected. SAML is planned.

## Requirements

- You are an **admin** of your Uptimeify organization.
- You can create an OIDC client (confidential, authorization code flow with PKCE) in your IdP.
- You can add a DNS TXT record for the email domain your team uses.

## 1. Create the client in your IdP

Create a confidential OIDC client and allow this redirect URI (shown in Uptimeify under **Settings → Security → Single sign-on** after the first save):

```
https://uptimeify.io/api/auth/sso/callback/org-<your-organization-id>
```

Scopes: `openid email profile`. The client secret stays with Uptimeify encrypted and is never shown again.

## 2. Set up SSO in Uptimeify

Go to **Settings → Security → Single sign-on (OIDC)** and fill in:

| Field | Meaning |
|---|---|
| Issuer URL | The issuer of your IdP, for example `https://login.microsoftonline.com/TENANT-ID/v2.0`. Uptimeify loads `/.well-known/openid-configuration` from it when you save. |
| Client ID, client secret | From step 1. Leave the secret empty later to keep the stored one. |
| Email domain | The domain of your team's addresses, for example `example.com`. One domain belongs to one organization only. |
| Role for new users | `Read only`, `Editor`, `Responder` or `Admin`. People who sign in via SSO for the first time get an account in your organization with this role. |

## 3. Verify the domain

Uptimeify shows a TXT record. Create it at your DNS provider, then click **Check**:

```
_uptimeify-sso.example.com  TXT  "uptimeify-sso=<token>"
```

SSO only works once the domain is verified. Changing the domain or the issuer requires verifying again.

## 4. Sign in

On the login page, click **Sign in with SSO**, enter your work email and you are redirected to your IdP. Existing accounts of your organization with the same email are reused; addresses that belong to another Uptimeify organization are rejected.

## SSO only

After the domain is verified and one SSO login succeeded, you can switch on **SSO only**. Team members can then no longer sign in with a password. Two exceptions:

- **Admins** keep password and 2FA as emergency access, in case your IdP is down or misconfigured.
- **Customer logins** (users with access to individual customers) are not affected.

## Provider examples

**Keycloak:** Client type OpenID Connect, client authentication on, standard flow on, PKCE method `S256`. Issuer: `https://keycloak.example.com/realms/REALM`. Make sure users have a verified email.

**Microsoft Entra ID:** App registration, platform "Web" with the redirect URI above, create a client secret. Issuer: `https://login.microsoftonline.com/TENANT-ID/v2.0`.

**Google Workspace:** Google Cloud console, OAuth client ID of type "Web application" with the redirect URI above. Issuer: `https://accounts.google.com`.

## Error messages

| Message | Meaning |
|---|---|
| SSO is not set up for this domain | No verified SSO for the email domain. Sign in with your password. |
| Address outside the verified domain | The IdP returned an email that does not end on the verified domain. |
| Address marked as unverified | The IdP sent `email_verified: false`. |
| Address belongs to a different organization | The email already has an account in another Uptimeify organization. |
| Account is deactivated | An admin deactivated this account in Uptimeify. |
| Your organization requires single sign-on | SSO only is on; use **Sign in with SSO**. |