Skip to main content
You configure SSO in your workspace settings, not in an individual app’s dashboard. First create an app with your identity provider, then add its credentials to your workspace.
Before you begin:
  • Workspace SSO uses OpenID Connect (OIDC), or OAuth for GitHub. If your provider also offers SAML, choose OIDC when you create the app.
  • Workspace SSO needs an Enterprise plan (Business or Enterprise). Workspaces created before October 2026 can also use workspace SSO on the Elite plan.
  • Find your workspace ID. You need it for the redirect URI. It is the string of characters after /workspace/ in your workspace URL. Your redirect URI is https://app.base44.com/api/workspaces/{{WORKSPACE_ID}}/auth/sso/callback.

​
Setting up your identity provider

Follow the steps for your provider to create the app and collect the values you enter in Base44. Microsoft Entra ID and Okta each need a few extra steps, so they have their own guides.

Microsoft Entra ID

Uses a dedicated app registration, and also supports SCIM provisioning.

Okta

Uses an OIDC app plus a couple of authorization-server settings.
For any other provider, create the app with your provider and collect its credentials.
Create an OAuth 2.0 client in Google Cloud, then enter its credentials in Base44.To create the Google app:
  1. In the Google Cloud Console, create an OAuth 2.0 Client ID of type Web application.
  2. Under Authorized redirect URIs, add your workspace redirect URI.
  3. Copy the Client ID and Client Secret.
Create a GitHub OAuth app, then enter its credentials in Base44.To create the GitHub app:
  1. In GitHub Developer Settings, create an OAuth app.
  2. Set the Authorization callback URL to your workspace redirect URI.
  3. Copy the Client ID and generate a Client Secret.
Connect any OpenID Connect provider by creating a client and entering its details in Base44.To create the app:
  1. Create an OIDC client with your provider, using your workspace redirect URI.
  2. Copy the Client ID and Client Secret.
  3. Find your provider’s Discovery URL, or its individual OIDC endpoints.

​
Adding your credentials in Base44

Once you have your provider’s credentials, add them to your workspace. For Microsoft Entra ID and Okta, follow their dedicated guides above instead, which include this step. To add your SSO credentials:
  1. Click your workspace name at the bottom left of your account.
  2. Click Settings.
  3. Click Authentication.
  4. Click Set Up next to Single Sign-on Configuration.
  5. In Select SSO Provider, choose your provider, or Advanced / Manual Configuration for another OIDC provider.
  6. Enter your Client ID and Client Secret, and keep Scope as openid email profile.
  7. For Advanced / Manual Configuration, also add your Discovery URL or the individual endpoints from your provider.
  8. Click Enable SSO.
Members can sign in once you verify their email domain. Set up verified domains and the default role in the same Authentication settings.

​
Testing your SSO login

Confirm that sign-in works before you roll SSO out to your team. The first time someone signs in, Base44 adds them to the workspace automatically with your default role. To test SSO:
  1. Log out of Base44, or open a private browser window.
  2. Go to your workspace’s login page.
  3. Enter an email address from one of your verified domains. Base44 then shows the SSO option for that domain.
  4. Click Log in with SSO and sign in through your identity provider.
  5. Confirm that you are redirected back to Base44 and added to the workspace as a member with your default role.
If sign-in fails, check that the redirect URI uses /api/workspaces/{{WORKSPACE_ID}}/..., your provider credentials are correct, and the email’s domain is verified. For provider-specific errors, see the Microsoft Entra ID or Okta guide.

​
Removing your SSO setup

Removing your SSO setup turns off SSO for your workspace and deletes your identity provider, along with the credentials you saved. Remove it when your team stops signing in to Base44 through that provider, or when you want to start your setup again from the beginning.
Only workspace owners and admins can remove an SSO setup. If your workspace moved to a plan without workspace SSO, you need to upgrade again before you can remove it.
After you remove it, your members sign in to Base44 the way they did before you set up SSO, for example with Google or with their email and password. If your apps let people sign in with your workspace SSO, that option goes away in those apps too.
If you only want to pause SSO, turn off the toggle next to Single Sign-on Configuration instead. Your provider details stay saved, and you can turn it back on anytime.
To remove your SSO setup:
  1. Click your workspace name at the bottom left of your account.
  2. Click Settings.
  3. Click Authentication.
  4. Under Single Sign-on Configuration, next to your provider, click Configure.
  5. Click Clear to empty the form.
    A screenshot of the SSO configuration form with the Clear button outlined

    Clearing your SSO setup

  6. Click Save SSO Settings.
  7. In the confirmation, click Remove setup.
To use SSO again after you remove it, add your credentials in Base44 again.