Skip to navigation
AdministerProvisioning

Single sign-on

Authenticate dashboard admins through your identity provider

SSO lets admins sign in to the Workforce dashboard through your identity provider (IdP). Set it up before SCIM provisioning.

SSO covers dashboard sign-in only. Employee AI clients use a separate OAuth flow. See Connect employee AI clients.

You need IdP admin access and the Manage users permission.

Configure OIDC

  1. Open Provisioning → Sync and click Configure SSO.

  2. In your IdP, register an OIDC web application with this redirect URI and the openid, email, and profile scopes:

    https://wf-api.merge.dev/api/v1/auth/sso/callback

    Copy it from the dialog. It must match exactly, including the trailing slash.

  3. Paste the Discovery URL, Client ID, and Client secret into the dialog. The discovery URL is the full .well-known/openid-configuration URL, not the bare issuer.

  4. Click Save configuration. This turns on Enable SSO.

  5. Test in an incognito window with your work email.

SSO signs in existing members only. Invite them from Team and roles or provision them with SCIM first.

Per-IdP setup

  1. Applications → Create App Integration → OIDC - OpenID Connect → Web Application.
  2. Sign-in redirect URI: https://wf-api.merge.dev/api/v1/auth/sso/callback.
  3. Assign the Groups that need dashboard access.
  4. Copy Client ID and Client secret from the General tab.
  5. Discovery URL: https://<your-org>.okta.com/.well-known/openid-configuration, or https://<your-org>.okta.com/oauth2/<AUTH_SERVER_ID>/.well-known/openid-configuration for a custom authorization server.

Requiring SSO

Turn on Require SSO under SSO settings once SSO works for your own account. It requires Enable SSO to be on. While it is on:

  • Password sign-in and password reset stop working
  • Anyone outside the IdP Groups assigned to the application cannot sign in
  • You cannot disconnect the configuration

Turning Enable SSO off also turns Require SSO off.

Provision your team and test in incognito first. Anyone without a working SSO sign-in, including you, is locked out.