Single Sign-On (SSO)

Authenticate through your own identity provider.

View as Markdown

SSO is available on the Enterprise plan.

Single Sign-On (SSO) lets you manage authentication through your own identity provider, instead of requiring your team to set up separate credentials for TalkJS. TalkJS supports SSO via OpenID Connect (OIDC).

Once SSO is configured, inviting a team member is enough to bring them on board. Instead of being issued a separate TalkJS password, they're redirected to your identity provider to authenticate when they accept the invite.

How it works

To use SSO, you first configure an OIDC connection for your project from your TalkJS dashboard, and register your preferred SSO domain, such as example.com. Once a domain is verified, any user invited to the project is redirected to the configured identity provider to sign in, instead of using a TalkJS-managed password.

Domain verification is handled directly by the TalkJS team. See Enable SSO.

Supported identity providers

TalkJS SSO works with any identity provider that supports OpenID Connect. Commonly used providers include:

If your identity provider isn't listed here, it likely still works, as long as it supports OIDC and exposes a discovery URL (or the equivalent details for manual configuration).

Enable SSO

SSO configuration is available from the Project Settings page in your TalkJS dashboard, in the Single Sign-on (SSO) section.

To set it up:

  1. Select Enable single sign-on.
  2. Configure your OIDC connection. In the field Discovery URL (.well-known), add your identity provider's discovery URL and select Fetch SSO Configuration. Your details are automatically retrieved.
  • Alternatively, you can configure your OIDC connection manually. Select Show manual configuration to display the required fields. Then enter the provider name, client ID, client secret, and endpoint details (authorization endpoint, token endpoint, userinfo endpoint, issuer URL, and JWKS URI). Select Save SSO configuration to save your settings.
  1. Contact us with the domain(s) that you'd like to verify for use in SSO. Domain verification is handled directly by the TalkJS team.

See also