> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# OIDC SSO Setup

> Connect Google, Microsoft Entra ID, Okta, or any OpenID Connect identity provider to CloudThinker

Set up OpenID Connect single sign-on between your identity provider and CloudThinker. Start the wizard at **Admin Settings → Identity and access → Setup SSO**, choose **OpenID Connect (OIDC)**, then fill the **IdP Config** step with an **Issuer URL**, **Client ID**, and **Client Secret** from your provider.

## Prerequisites

* A verified email domain and an eligible plan — see [Single Sign-On](/guide/security/sso)
* Admin access to your identity provider

<Info>
  When registering CloudThinker as an OAuth client, your provider asks for a redirect URI. CloudThinker's OIDC callback path is `/api/v1/sso/oidc/callback` on your CloudThinker domain.
</Info>

## Provider setup

<Tabs>
  <Tab title="Google">
    <Steps>
      <Step title="Create an OAuth client">
        Go to [console.cloud.google.com](https://console.cloud.google.com) → **APIs & Services → Credentials → Create Credentials → OAuth client ID**, with application type **Web application**.
      </Step>

      <Step title="Add the redirect URI">
        Add CloudThinker's OIDC callback URL under **Authorized redirect URIs** and click **Create**, then copy the **Client ID** and **Client Secret**.
      </Step>

      <Step title="Finish in CloudThinker">
        On the **IdP Config** step, enter:

        * **Issuer URL**: `https://accounts.google.com`
        * **Client ID** and **Client Secret**: from the OAuth client

        Click **Create Connection**.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Microsoft Entra ID">
    <Steps>
      <Step title="Register an application">
        In the [Azure Portal](https://portal.azure.com), go to **Microsoft Entra ID → App registrations → New registration**. Name it **CloudThinker**, and under **Redirect URI** select **Web** and paste CloudThinker's OIDC callback URL.
      </Step>

      <Step title="Create a client secret">
        Go to **Certificates & secrets → New client secret** and copy the secret **Value** immediately — it is shown only once.
      </Step>

      <Step title="Finish in CloudThinker">
        On the **IdP Config** step, enter:

        * **Issuer URL**: `https://login.microsoftonline.com/{tenant-id}/v2.0`
        * **Client ID**: the **Application (client) ID** from the registration overview
        * **Client Secret**: the secret value you copied

        Click **Create Connection**.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Okta">
    <Steps>
      <Step title="Create an OIDC app">
        In the Okta Admin Console, go to **Applications → Create App Integration → OIDC - OpenID Connect → Web Application**.
      </Step>

      <Step title="Configure the redirect URI">
        Under **Sign-in redirect URIs**, paste CloudThinker's OIDC callback URL and save.
      </Step>

      <Step title="Finish in CloudThinker">
        On the **IdP Config** step, enter:

        * **Issuer URL**: `https://your-org.okta.com`
        * **Client ID** and **Client Secret**: from the Okta app's **General** tab

        Click **Create Connection**.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Generic OIDC">
    Works with any OpenID Connect-compliant provider that publishes a discovery document.

    <Steps>
      <Step title="Register CloudThinker as an OAuth client">
        Create a new OAuth 2.0 / OIDC web application in your provider and add CloudThinker's OIDC callback URL as a redirect URI.
      </Step>

      <Step title="Finish in CloudThinker">
        | Field             | Description                                                                                               |
        | ----------------- | --------------------------------------------------------------------------------------------------------- |
        | **Display Name**  | Any label, for example "Okta OIDC"                                                                        |
        | **Issuer URL**    | Your provider's issuer — CloudThinker reads `<issuer>/.well-known/openid-configuration` for its endpoints |
        | **Client ID**     | The client ID your provider issued                                                                        |
        | **Client Secret** | The client secret your provider issued                                                                    |

        Click **Create Connection**.
      </Step>
    </Steps>
  </Tab>
</Tabs>

## Troubleshooting

<AccordionGroup>
  <Accordion title="'Redirect URI mismatch' from the identity provider">
    The redirect URI registered in your provider must exactly match CloudThinker's OIDC callback URL, including `https://` and the full path.
  </Accordion>

  <Accordion title="'Invalid client' or authentication fails immediately">
    Re-check the **Client ID** and **Client Secret** — Entra ID shows the secret value only once at creation, and expired secrets must be replaced in both places.
  </Accordion>

  <Accordion title="Issuer or discovery errors">
    The **Issuer URL** must be the provider's issuer base (for example `https://accounts.google.com`), not the full `.well-known/openid-configuration` address.
  </Accordion>
</AccordionGroup>

## Next steps

<CardGroup cols={2}>
  <Card title="Test and Enforce SSO" icon="key" href="/guide/security/sso">
    Test the connection, turn on Require SSO, and choose a provisioning mode
  </Card>

  <Card title="SCIM Provisioning" icon="users-gear" href="/guide/security/scim">
    Sync users and groups automatically from your identity provider
  </Card>
</CardGroup>