> For the complete documentation index, see [llms.txt](https://doc.anytype.io/anytype/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.anytype.io/anytype/anytype-for-business/sign-in/custom-sso.md). # Custom SSO (OIDC) Connect your company's OpenID Connect (OIDC) identity provider so people sign in with their work accounts. The Admin Console has presets for: * Okta * Microsoft Entra ID * Keycloak * Authentik * Zitadel * Authelia * Other OIDC Set up SSO in **Settings** → **Single sign-on**. Only the owner can change it. Admins can view it. If Anytype support set up your connection, contact support to change it. {% hint style="warning" %} Activating SSO needs a paid plan. During the trial you can verify domains, connect your provider and run tests. To activate, click **Go to billing** and subscribe. {% endhint %} Setup has five steps: **Domains**, **Identity provider**, **Test sign-in**, **Activate** and **Enforce**. Each step unlocks when the previous one is done. ## 1. Verify your domains Prove you own each email domain with a DNS TXT record. 1. Enter your domain, for example `acme.com`, and click **Add domain**. 2. At your DNS provider, add a TXT record with the **Host** and **Value** shown. The host looks like `_anytype-challenge.acme.com`. If your DNS provider adds the domain for you, enter only `_anytype-challenge`. 3. Click **Check now**. DNS changes usually appear within minutes but can take up to 48 hours. To check the record yourself, run the **Self-check** command in a terminal: ``` dig TXT _anytype-challenge.acme.com +short ``` You can add up to 10 domains. You can't add public email domains such as `gmail.com`, or a domain another organization has already verified. If another organization claimed your domain, email . ## 2. Connect your identity provider 1. Choose your provider's preset. It shows setup steps for that provider. 2. In your identity provider, create a web application with the values under **Add these in your identity provider**: * **Redirect URI** * **Scopes:** `openid email profile` (Okta and Authelia also add `groups`) * **Grant type:** Authorization code 3. In the Admin Console, fill in **Paste from your identity provider**: * **Display name:** shown on the sign-in button, for example "Acme" * **Domains:** the verified domains this connection covers * **Issuer URL:** a public `https://` address * **Client ID** and **Client secret** 4. Click **Save** and check the **Identity provider check** result. {% hint style="info" %} For Microsoft Entra ID, use your tenant's issuer: `https://login.microsoftonline.com//v2.0`. The `common` issuer doesn't work. {% endhint %} ### Provisioning * **Automatic sign-up (JIT):** on by default. New people on your domains join when they first sign in through your provider. Turn it off to require an invitation for new people. * **Default role:** the role for people who join automatically. **Member** by default, or **Admin**. ### Advanced Under **Advanced** you can change scopes, PKCE, claim mapping, **Token endpoint auth method** (`client_secret_basic` or `client_secret_post`) and **Email trust**. **Email trust** starts at **Preset default**: * Keycloak, Zitadel and Other OIDC require the provider to mark the email as verified. * Okta, Microsoft Entra ID, Authentik and Authelia trust any address on your verified domains. You can override this with **Require the IdP's email\_verified** or **Trust addresses on my verified domains**. ### Replace the provider After saving, you can't edit the issuer or client ID. To change them, click **Replace identity provider**, then **Delete and set up again**. Set up, test and activate the new connection. If SSO was enforced before, turn enforcement on again. Members keep their accounts and are linked to the new provider by email when they next sign in. ## 3. Test sign-in Click **Run test** and sign in in the new tab with an account on one of your domains. Finish within 10 minutes. The test doesn't create accounts or sessions. Run the test again after you change the client secret, the provider preset or anything under **Advanced**. ## 4. Activate Before you activate, the page shows how many of your members use these domains. They're linked to SSO on their first SSO sign-in. Click **Activate**. When someone enters an email on one of your domains, the sign-in page shows **Continue with {display name} SSO**. ## 5. Enforce (optional) Turn on **Enforce single sign-on**, check the affected members and confirm. Members on your domains then sign in only through your provider. The owner is exempt by default and can still use their other sign-in method, so a broken provider can't lock you out. Anytype records each of these sign-ins and sends an email about it. To stop enforcing, turn the switch off and confirm. Members can use their other sign-in methods again. Saving a new client secret, a different provider preset or changes under **Advanced** turns enforcement off. The button then reads **Save and turn off enforcement**. Run a new test, then turn enforcement on again. ## Disable or delete the connection In the **Danger zone**: * **Disable:** nobody can sign in through the connection until you activate it again. * **Delete connection:** removes the provider settings and SSO links. Your domains stay verified. Members who signed in only through SSO then use email codes. To remove a domain, first uncheck it under **Identity provider** and save. Then remove it under **Domains**. To remove the last domain, delete the connection first. ## What members see Members enter their work email and click **Continue with {display name} SSO** to go to your identity provider. People on your domain who aren't in your organization can click **Not part of {display name}? Sign in with email**. ## Troubleshooting
"Not part of this organization" The account's email domain isn't in this SSO connection. Sign in with an account on one of the connection's domains.
"You're not a member yet" Automatic sign-up is off and the person hasn't been invited. Invite them from **Members**, or turn on **Automatic sign-up (JIT)**.
"Email not verified" The provider didn't send an email address, or didn't mark it as verified. * Missing address: check the `email` scope and **Claim: email** under **Advanced**. * Not verified: if your provider never sends `email_verified`, set **Email trust** to **Trust addresses on my verified domains**.
"Sign-in session didn't match" The sign-in finished in a different browser from the one it started in, or cookies are blocked. Try again in the same browser with cookies allowed.
"Couldn't reach the sign-in service" Anytype couldn't connect to your identity provider or load its settings. Check that the provider is online and the issuer URL is correct.
"We couldn't read the OpenID configuration at this issuer" Check the issuer URL and that its OpenID configuration is publicly reachable. For Entra ID, use your tenant's issuer, not `common`.
"Your identity provider rejected the client ID, secret or authentication method" Check the client ID and secret. Under **Advanced**, set **Token endpoint auth method** to the one your provider uses.
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://doc.anytype.io/anytype/anytype-for-business/sign-in/custom-sso.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.