Configure OpenID Connect work SSO

1. Create an OIDC application in your identity provider

Use Microsoft Entra ID, Okta, Auth0, Google Workspace, or another standards-compliant OpenID Connect provider. Configure an authorization-code web application and keep its client secret private.

2. Register the EvalcueAI callback URL

Set the redirect URI to your EvalcueAI API origin followed by /api/sso/callback. The URI must exactly match the redirect registered with your identity provider.

3. Copy the issuer, client ID, and client secret

The issuer should be the provider’s OpenID Connect issuer URL—not an authorization endpoint copied by hand. EvalcueAI validates discovery metadata before enabling the configuration.

4. Claim your work email domains

Add the organization domains whose asserted email identities may enter this EvalcueAI organization. A domain can be enabled for only one organization at a time.

5. Choose membership provisioning

With just-in-time provisioning disabled, an Owner or Admin must add the user to the organization before SSO succeeds. With JIT enabled, a successful identity can be added automatically using the configured default role.

6. Test with a least-privilege account

Start with Reviewer as the JIT default and validate a non-admin user before rolling SSO out broadly. Owner and Admin roles are never issued through JIT provisioning.

Security behavior

• OIDC issuer and discovered endpoints must use public HTTPS endpoints.
• State, nonce, and PKCE protect the browser authorization flow.
• ID tokens are verified for signature, issuer, audience, nonce, and allowed work email domain.
• Client secrets are encrypted at rest and never returned by the settings API.
• The browser receives a short-lived, single-use EvalcueAI exchange code rather than an access token in the redirect URL.
• Disabled or removed organization membership blocks session exchange even after the identity provider has authenticated the user.