Open console
Admin guideMembers and roles, sign-in, your own runners, runtime health, transcripts and runs.

Admin guide · Security

Single sign-on

Everyone signs in through your identity provider with OpenID Connect. Group membership maps to a console role, and the console never stores a password for them.

WhereSettings › Security › Single sign-on
WhoAn admin, or anyone whose role may configure single sign-on
PlansTeam and above
The Single sign-on page: Require single sign-on, the Redirect URI with a Copy button, and Identity providers with Add identity provider
Single sign-on: copy the Redirect URI, add your identity provider, test it, then require it. Click to open full size.

Set it up

  1. Copy the Redirect URI and paste it into your identity provider when you register the console as an application.
  2. Press Add identity provider and fill in Name, Issuer, Client ID and Client secret from that application.
  3. Email domains (comma separated): the domains this provider signs in.
  4. Default role (when no group matches), or none, so unmapped people are refused.
  5. Group to role mappings, and Group to space or job to give a group one space or one job.
  6. The endpoints come from discovery; fill Authorization endpoint, Token endpoint or JWKS URI only if your provider has none. Set Scopes and the Group claim if yours differ.
  7. Tick Enabled - offered at sign-in, save, and press Test.

Require it for everyone

Once a test sign-in works, turn on Require single sign-on: everyone in the organisation then signs in through an identity provider, and password sign-in is turned off.

People and groups from your directory. Settings › Security › Directory (AD / SCIM) keeps members and groups in step with your directory, on Enterprise.

Last updated October 29, 2026