What you'll need from your identity provider
Before configuring SSO, create a new OIDC application in your identity provider's admin console (Okta, Azure AD, Google Workspace, Auth0, or any other OIDC-compatible provider). You'll need three values from it: the issuer URL, the client ID, and the client secret.
When your identity provider asks for a redirect URI (sometimes called a callback URL), use your Inkbox SAS API's SSO callback address. Your platform operator can confirm the exact URL for your deployment.
Configuring SSO in your dashboard
From your organization's page in the client dashboard, open the "Single sign-on (SSO)" section (visible to the organization owner and anyone with the settings permission). Enter the issuer URL, client ID, and client secret you got from your identity provider, then save.
The client secret is never shown again after you save it. If you need to change it later, just paste a new one; leaving the field blank on a later save keeps the current secret unchanged.
Toggle "Enable SSO sign-in for this organization" once you're ready to let people use it. You can turn it off at any time without losing your saved configuration.
How your employees sign in
On the Inkbox SAS login page, employees click "Sign in with your company SSO", type your organization's identifier (the same short slug shown in your dashboard's SSO section), and get redirected to your identity provider to authenticate.
After they approve on your identity provider's side, they're brought back and signed in directly, no separate Inkbox SAS password is needed. The very first time someone signs in this way, an account is created for them automatically and attached to your organization.
How it stays secure
The login flow uses PKCE and a single-use state token, so an intercepted or replayed authorization link can't be reused to sign in as someone else. Your client secret is encrypted at rest and is never returned by the API once saved.
SSO is opt-in per organization: enabling it for yours has no effect on any other organization on the platform, and it doesn't disable regular email/password login unless you decide to stop using it for a given account.
© 2026 Inkbox SAS