---
url: https://talkjs.com/docs/Features/Security/Single_Sign-On
---

# Single Sign-On (SSO)

Authenticate through your own identity provider.

Ask a question Copy for LLM [View as Markdown](/docs/Features/Security/Single_Sign-On.md)

SSO is available on the [Enterprise plan](/pricing/).

Single Sign-On (SSO) lets you manage authentication through your own identity provider, instead of requiring your team to set up separate credentials for TalkJS. TalkJS supports SSO via [OpenID Connect](https://openid.net/developers/how-connect-works/) (OIDC).

Once SSO is configured, inviting a team member is enough to bring them on board. Instead of being issued a separate TalkJS password, they're redirected to your identity provider to authenticate when they accept the invite.

## How it works

To use SSO, you first configure an OIDC connection for your project from your TalkJS dashboard, and register your preferred SSO domain, such as `example.com`. Once a domain is verified, any user invited to the project is redirected to the configured identity provider to sign in, instead of using a TalkJS-managed password.

Domain verification is handled directly by the TalkJS team. See [Enable SSO](#enable-sso).

## Supported identity providers

TalkJS SSO works with any identity provider that supports OpenID Connect. Commonly used providers include:

- [Okta](https://www.okta.com/products/single-sign-on-workforce-identity/)
- [Google Workspace](https://knowledge.workspace.google.com/admin/apps/about-sso)
- [Microsoft Entra ID](https://www.microsoft.com/en-us/security/business/identity-access/microsoft-entra-single-sign-on) (formerly Azure AD)
- [Auth0](https://auth0.com/docs/authenticate/single-sign-on)
- [Keycloak](https://www.keycloak.org/securing-apps/oidc-layers)
If your identity provider isn't listed here, it likely still works, as long as it supports OIDC and exposes a discovery URL (or the equivalent details for manual configuration).

## Enable SSO

SSO configuration is available from the **Project Settings** page in your [TalkJS dashboard](/dashboard), in the **Single Sign-on (SSO)** section.

To set it up:

1. Select **Enable single sign-on**.
2. Configure your OIDC connection. In the field **Discovery URL (.well-known)**, add your identity provider's discovery URL and select **Fetch SSO Configuration**. Your details are automatically retrieved.

- Alternatively, you can configure your OIDC connection manually. Select **Show manual configuration** to display the required fields. Then enter the provider name, client ID, client secret, and endpoint details (authorization endpoint, token endpoint, userinfo endpoint, issuer URL, and JWKS URI). Select **Save SSO configuration** to save your settings.

1. Contact us with the domain(s) that you'd like to verify for use in SSO. Domain verification is handled directly by the TalkJS team.

## See also

- [Authentication](/docs/Features/Security/Authentication/) covers how TalkJS verifies user identity more generally.
- [Security recommendations](/docs/Features/Security/) on steps to keep your chat and user data secure.