Skip to main content
Single sign-on (SSO) lets your users sign in to Veridox with their work account, such as Microsoft Entra ID, Okta or Google Workspace. Veridox supports any identity provider that uses OpenID Connect (OIDC). SSO is set up in the Veridox dashboard. It is not available via the API.

​
Before You Start

  • Veridox must enable SSO for your organisation. Contact Veridox support to ask.
  • You need organisation_sso:write, which the Owner role holds by default. Without it, the Single sign-on page does not appear.

​
Step 1: Register Veridox in Your Identity Provider

Register a web application with a client secret. A single-page application will not work, because sign-in needs a client secret. Redirect URI — use the one for your region: Scopes: openid, email, profile Claims: your identity provider must send each user’s email address, and ideally their first and last name (email, given_name, family_name).
Microsoft Entra ID does not send email by default. Choose Entra user principal name (preferred_username) as the email claim in Step 2.

​
Step 2: Enter Your Details in Veridox

  1. Sign in to your regional dashboard:
  2. Go to Settings → Single sign-on.
  3. Enter the Issuer URL, Client ID and Client secret from your identity provider. Common issuer URLs:
    • Entra: https://login.microsoftonline.com/{tenant-id}/v2.0
    • Okta: https://your-org.okta.com
    • Google: https://accounts.google.com
  4. Enter the secret’s Expires on date, if it has one.
  5. Choose the Email claim, then save.
Veridox checks your details with your identity provider before saving. The client secret is stored securely and never shown again.

​
Step 3: Turn On SSO Sign-In

Contact Veridox support with the email domains your users sign in with, for example example.com. Veridox adds the domains and turns on SSO sign-in. Until then, everyone signs in with their password.
Once SSO sign-in is on, password sign-in is blocked for everyone in your organisation, including members whose email domain is not on the list. Give Veridox support every member’s email domain.

​
What Your Users See

  • Sign-in: users enter their email address and are sent straight to your identity provider.
  • First sign-in: an existing Veridox account in your organisation is linked automatically. If there is no account, a new one is created with the Member role. If the email address belongs to an account in another organisation, sign-in fails; contact Veridox support.
  • Sign-out: signing out of Veridox also ends the SSO session.

​
Related