> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Setting up SSO for your enterprise workspace

> Connect your identity provider to your Base44 enterprise workspace so your team signs in with their company credentials.

You configure SSO in your workspace settings, not in an individual app's dashboard. First create an app with your identity provider, then add its credentials to your workspace.

<Tip>
  **Before you begin:** Find your workspace ID. You need it for the redirect URI. It is the string of characters after `/workspace/` in your enterprise workspace URL. Your redirect URI is `https://app.base44.com/api/workspaces/{{WORKSPACE_ID}}/auth/sso/callback`.
</Tip>

***

## Setting up your identity provider

Follow the steps for your provider to create the app and collect the values you enter in Base44.

### Microsoft Entra ID

Microsoft Entra ID uses a dedicated app registration and also supports SCIM provisioning. Follow the full flow in [Setting up SSO for Microsoft Entra ID](/Enterprise/Microsoft-Entra-SSO).

### Okta

Okta uses an OIDC app plus a couple of authorization-server settings. Follow the full flow in [Setting up SSO for Okta](/Enterprise/Okta-SSO).

### Google Workspace

Create an OAuth 2.0 client in Google Cloud, then enter its credentials in Base44.

**To create the Google app:**

1. In the [Google Cloud Console](https://console.cloud.google.com/apis/credentials), create an **OAuth 2.0 Client ID** of type **Web application**.
2. Under **Authorized redirect URIs**, add your workspace redirect URI.
3. Copy the **Client ID** and **Client Secret**.

### GitHub

Create a GitHub OAuth app, then enter its credentials in Base44.

**To create the GitHub app:**

1. In [GitHub Developer Settings](https://github.com/settings/developers), create an **OAuth app**.
2. Set the **Authorization callback URL** to your workspace redirect URI.
3. Copy the **Client ID** and generate a **Client Secret**.

### Other OIDC providers

Connect any OpenID Connect provider by creating a client and entering its details in Base44.

**To create the app:**

1. Create an OIDC client with your provider, using your workspace redirect URI.
2. Copy the **Client ID** and **Client Secret**.
3. Find your provider's **Discovery URL**, or its individual OIDC endpoints.

***

## Adding your credentials in Base44

Once you have your provider's credentials, add them to your workspace. For Microsoft Entra ID and Okta, follow their dedicated guides above instead, which include this step.

**To add your SSO credentials:**

1. Click your workspace name at the top left of your account.
2. Click **Settings**.
3. Click **Auth and security**.
4. Enable the toggle next to **Single Sign-On Configuration**.
5. In **Select SSO Provider**, choose your provider, or **Advanced / Manual Configuration** for another OIDC provider.
6. Enter your **Client ID** and **Client Secret**, and keep **Scope** as `openid email profile`.
7. For Advanced / Manual Configuration, also add your **Discovery URL** or the individual endpoints from your provider.
8. Click **Enable SSO**.

<Note>
  Members can sign in once you verify their email domain. Set up [verified domains and the default role](/Enterprise/SSO-for-enterprise-workspace#verified-domains) in the same **Auth and security** settings.
</Note>

***

## Testing your SSO login

Confirm that sign-in works before you roll SSO out to your team. The first time someone signs in, Base44 adds them to the workspace automatically with your default role.

**To test SSO:**

1. Log out of Base44, or open a private browser window.
2. Go to your workspace's login page.
3. Enter an email address from one of your verified domains. Base44 then shows the SSO option for that domain.
4. Click **Log in with SSO** and sign in through your identity provider.
5. Confirm that you are redirected back to Base44 and added to the workspace as a member with your default role.

<Tip>
  If sign-in fails, check that the redirect URI uses `/api/workspaces/{{WORKSPACE_ID}}/...`, your provider credentials are correct, and the email's domain is verified. For provider-specific errors, see the [Microsoft Entra ID](/Enterprise/Microsoft-Entra-SSO) or [Okta](/Enterprise/Okta-SSO) guide.
</Tip>