Single sign-on (OIDC)

"Continue with SSO" on your Gateway's sign-in page.

Adds Continue with SSO to your Gateway's sign-in page, for people you've invited. Sign-in

Open your identity provider's admin console and create an OpenID Connect client (web application, authorization code).
Add the redirect URL https://<your gateway>/api/auth/callback/oidc.
Copy:
- OIDC_SIGNIN_ISSUER: The issuer URL (https://…), which serves /.well-known/openid-configuration.
- OIDC_SIGNIN_CLIENT_ID: The client ID.
- OIDC_SIGNIN_CLIENT_SECRET: The client secret.

Cloudflare Access has its own settings (CLOUDFLARE_ACCESS_OIDC_*, everyapp access): use those for Access, this for Okta, Keycloak, Auth0, Authentik, Google Workspace as an OIDC issuer and the like. For Microsoft Entra ID use the microsoft provider: Entra's ID tokens carry no email_verified, so through this entry every sign-in would be refused as unverified.
ID tokens must be signed with RS256 (every major provider's default).

Optional: OIDC_SIGNIN_LABEL, The button text after "Continue with" (default "SSO").

Turn it on. It asks for each value:

everyapp signin add oidc

Check it worked: everyapp signin show oidc shows each setting as set. Then sign out and select the button.

More help

Ask your coding agent to set Single sign-on (OIDC) up: the everyapp skill has the full guide (setup/signin-oidc.md).

Something wrong or missing? Open an issue.