Setting up Single Sign-On (SSO) for Your App

Let your team log in to your Base44 app using Google, Microsoft, GitHub, or Okta instead of separate logins.

Step 1 | Get started with SSO

SSO lets your team sign in to your Base44 app using an existing authentication provider, such as Google, Microsoft, GitHub, or Okta. Start by finding your Base44 app ID and redirect URI. You will use this redirect URI when you set up any SSO provider in Base44.

Single sign-on (SSO) is available for Base44 apps on the Elite plan or higher.

To find your Base44 app ID and redirect URI:

1. Go to your app editor in Base44.

2. Check your browser’s address bar and find the app ID between /apps/ and /editor/ in the URL.

3. Build your redirect URI by replacing {{APP_ID}} in this format with your app ID:

   https://app.base44.com/api/apps/{{APP_ID}}/auth/sso/callback
   

Example: from app URL to redirect URI

With the app editor open, the URL might look like this:

https://app.base44.com/apps/686404784ac37377589a1f7f/editor/...

Here, 686404784ac37377589a1f7f is the app ID. Plug that into the format:

https://app.base44.com/api/apps/686404784ac37377589a1f7f/auth/sso/callback

This is the redirect URI you’ll enter with your SSO provider.

Step 2 | Choose your provider

Start by choosing the identity provider your team already uses. You can pick a built-in option (Google, Microsoft, GitHub, or Okta), or use Advanced / Manual configuration to connect any OIDC provider.

Google Workspace

Allow sign-in with Google Workspace accounts.

Microsoft 365 / Entra ID

Allow sign-in with Microsoft 365 or Entra ID.

GitHub

Allow sign-in with GitHub accounts.

Okta

Allow sign-in with your Okta directory.

Advanced / Manual configuration

Connect any OIDC-compatible provider using custom endpoints.

Google Workspace

Use Google Workspace as your SSO provider with an OAuth 2.0 Web application. First, create an OAuth 2.0 client in Google Cloud Console for your project, then add those credentials in Base44.

Before you set up SSO, you’ll need:

• A client ID and client secret from Google Cloud
• Your app’s redirect URI (see Step 1)

Check out Google’s credential setup guide

To set up Google Workspace SSO in Base44:

1. In your app editor, click Dashboard.
2. Click Settings.
3. Click Authentication.
4. Click Set Up next to Single sign-on (SSO).
5. In Select SSO provider, and choose Google Workspace.
6. Enter your Client Id and Client Secret from Google.
7. Keep Scope as openid email profile.
8. Leave Discovery Url set to the default value.
9. Click Enable SSO.

Google Workspace SSO settings in your Base44 app

Microsoft

Use Microsoft Entra ID (Azure AD) as your SSO provider through your Azure portal.

Before you set up SSO, you’ll need:

• Application (client) ID, directory (tenant) ID, and client secret from Azure
• Your app’s redirect URI (see Step 1)
• Scopes including openid, email, profile, and User.Read

Check out Microsoft identity platform registration

To set up Microsoft SSO in Base44:

1. In your app editor, click Dashboard.

2. Click Settings.

3. Click Authentication.

4. Click Set Up next to Single sign-on (SSO).

5. In Select SSO provider, choose Microsoft Azure AD.

6. Enter your Azure Application (client) ID, Client Secret, and Directory (tenant) ID.

7. Keep Scope as openid email profile.

8. For Discovery Url, enter:

   https://login.microsoftonline.com/{TENANT_ID}/v2.0/.well-known/openid-configuration
   

   Replace {TENANT_ID} with your directory (tenant) ID from the Azure portal.

9. Click Enable SSO.

Microsoft Azure AD SSO settings in your Base44 app

GitHub

Use a GitHub OAuth app as your SSO provider. Create an OAuth app in GitHub Developer Settings, then connect it in Base44.

Before you set up SSO, you’ll need:

• A GitHub OAuth app created in GitHub Developer Settings
• The app’s authorization callback URL set to your redirect URI (see Step 1)
• Client ID and client secret generated by GitHub for your OAuth app

Check out GitHub’s OAuth app guide

To set up GitHub SSO in Base44:

1. In your app editor, click Dashboard.
2. Click Settings.
3. Click Authentication.
4. Click Set Up next to Single sign-on (SSO).
5. In Select SSO provider, choose GitHub.
6. Enter your GitHub Client Id and Client Secret.
7. Keep Scope as user:email.
8. Keep the default Auth Endpoint, Token Endpoint, and Userinfo Endpoint values for GitHub.
9. Click Enable SSO.

GitHub SSO settings in your Base44 app

Okta

Use Okta as your SSO provider. In your Okta Admin Console, create an OIDC Web application for your Base44 app, then add the credentials in Base44.

Before you set up SSO, you’ll need:

• Okta client ID and client secret
• Your Okta domain (e.g. your-company.okta.com)
• Discovery URL from Okta issuer For example: https://your-company.okta.com/oauth2/default/.well-known/openid-configuration
• Scopes including openid email profile

Check out Okta’s SSO for Native apps guide

To set up Okta SSO in Base44:

1. In your app editor, click Dashboard.
2. Click Settings.
3. Click Authentication.
4. Click Set Up next to Single sign-on (SSO).
5. In Select SSO provider, choose Okta.
6. Enter the following:
   • Client Id: Your Okta client ID.
   • Client Secret: Your Okta client secret.
   • Okta Domain: Your Okta domain (e.g.your-company.okta.com).
   • Scope: Keep openid email profile.
   • Discovery Url: Your Okta discovery URL.
7. Click Enable SSO.

Okta SSO settings in your Base44 app

Advanced / Manual configuration

Use Advanced / Manual configuration to connect any OIDC-compatible identity provider that is not covered by the built-in options.

Before you set up SSO, you’ll need:

• OIDC client credentials from your provider
• Your app’s redirect URI (see Step 1)
• Discovery URL or all OIDC endpoints from your provider
• Required scopes (openid email profile or equivalent)

Check your provider’s documentation for details

To set up Advanced / Manual configuration in Base44:

1. In your app editor, click Dashboard.
2. Click Settings.
3. Click Authentication.
4. Click Set Up next to Single sign-on (SSO).
5. In Select SSO provider, choose Advanced / Manual Configuration.
6. Fill in the following fields using your provider’s values:
   • Name: A name for this SSO configuration (for example, Auth0, Keycloak, or your IdP name).
   • Client Id: Your OIDC client ID.
   • Client Secret: Your OIDC client secret.
   • Scope: Keep openid email profile.
   • Discovery Url: Your provider’s discovery URL, if available.
   • Auth Endpoint, Token Endpoint, Userinfo Endpoint, Jwks Uri: If you are not using a discovery URL, paste each endpoint from your provider’s documentation.
7. Click Enable SSO.

Advanced / Manual SSO configuration in your Base44 app

Step 3 | Test your SSO login

After setting up SSO, test that everything works as expected.

To test your SSO login:

1. Log out of your app if you are currently signed in.
2. Go to your app’s login screen.
3. Click Log in with SSO or select the provider you configured.
4. Sign in using an email address from your approved domain.

You’ll be logged in automatically.

FAQs

Click a question to learn more about SSO.

Do I need to set up SSO if I only use one login?

No, SSO is optional. You can continue using your existing login method if it works for you. If you want your team to log in with Google, Microsoft, GitHub, or Okta, you can set up SSO and configure the provider you use.

What is a redirect URI and where do I use it?

A redirect URI tells your identity provider (like Google or Microsoft) where to send people after they log in. You enter it when you set up SSO in your provider’s dashboard. It should look like this:

https://app.base44.com/api/apps/{{APP_ID}}/auth/sso/callback

Make sure to replace {{APP_ID}} with your actual Base44 app ID.

What is a discovery URL and do I need to add it?

A discovery URL tells Base44 how to connect to your identity provider. It helps Base44 automatically find the right endpoints and configuration values. You only need this for some providers.

• For Google, you do not need to enter a discovery URL. Base44 handles it automatically.
• For Microsoft (Azure / Entra ID) and Okta, your provider gives you a discovery URL. Copy it into the Discovery Url field in your Base44 SSO settings.
• For GitHub, you can leave the discovery URL field blank.

If your provider gives you a discovery URL, paste it into the Discovery Url field in your Base44 SSO settings. If not, you can leave it empty.

What if I see an error when logging in using SSO?

Check the following:

• Your redirect URI in Base44 exactly matches the one in your provider’s dashboard.
• Your client ID, client secret, and, if used, Discovery Url are correct.
• The scope is set as openid email profile in both your provider’s configuration and in Base44 (or an equivalent email scope).

If SSO fails after checking all fields, contact support with screenshots of your settings.

Why does the Google login still show "base44.com" instead of my app name after setting up custom SSO?

If Google still shows base44.com as the app name or badge, your custom Google project has not been fully approved yet. Once Google approves your project, your app’s own name or branding will appear instead of base44.com.

How can I make sure my app name appears in the Google login instead of "base44.com"?

Finish setting up your custom SSO, publish your app, and submit your Google project for approval. After Google approves the project, your app name or branding will appear during sign-in instead of base44.com.

Which applications commonly use SSO or OAuth?

Many services support SSO or OAuth when working with enterprise or managed accounts, including: Langfuse, OpenAI, Anthropic, Mongo, Mixpanel, Mintlify, SendGrid, FeatureBase, Cloudflare, Logfire, GitHub, GCP, Render, AWS, Deno, Gong, Appspot, DocuSign, and Modal.