> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# auth sso

> Configure SSO identity providers for your app from the CLI

Configure Single Sign-On (SSO) so end users can sign in to your app through an external identity provider. Supported providers are Google, Microsoft, GitHub, Okta, and any custom OIDC-compliant provider.

SSO and [social login](/developers/references/cli/commands/auth-social-login) are mutually exclusive. Enabling SSO disables any active social login providers, and enabling a social login provider disables SSO.

This command updates your local auth config and immediately saves the provider credentials to Base44's secrets store. The SSO toggle itself is applied to your deployed app only after you run [`auth push`](/developers/references/cli/commands/auth-push) or [`deploy`](/developers/references/cli/commands/deploy).

## Usage

Enable SSO with a provider's OAuth credentials:

```bash theme={null}
base44 auth sso enable --provider google --client-id <id> --client-secret <secret>
```

Disable SSO:

```bash theme={null}
base44 auth sso disable
```

## Arguments

| Argument            | Description                       | Required |
| ------------------- | --------------------------------- | -------- |
| `<enable\|disable>` | Whether to enable or disable SSO. | Yes      |

## Flags

All flags below apply to `enable`. `disable` takes no flags. Required flags depend on the provider, see [Per-provider requirements](#per-provider-requirements).

| Flag                        | Description                                                                                                                                                    |
| --------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `--provider <provider>`     | SSO provider: `google`, `microsoft`, `github`, `okta`, or `custom`.                                                                                            |
| `--client-id <id>`          | OAuth client ID.                                                                                                                                               |
| `--client-secret <secret>`  | OAuth client secret.                                                                                                                                           |
| `--client-secret-stdin`     | Read the client secret from stdin.                                                                                                                             |
| `--env-file <path>`         | Read the client secret from a `.env` file. The file must contain a `sso_client_secret` key. Cannot be combined with `--file`.                                  |
| `--file <path>`             | JSON config file with all SSO settings, see [Config file format](#config-file-format). Flag values override file values. Cannot be combined with `--env-file`. |
| `--scope <scope>`           | OAuth scope. Defaults to `openid email profile` for OIDC providers and `user:email` for GitHub.                                                                |
| `--discovery-url <url>`     | OIDC discovery URL. Derived automatically for `google`, `microsoft`, and `okta`.                                                                               |
| `--tenant-id <id>`          | Microsoft Entra tenant ID. Required for `microsoft`.                                                                                                           |
| `--okta-domain <domain>`    | Okta domain, such as `myorg.okta.com`. Required for `okta`.                                                                                                    |
| `--auth-endpoint <url>`     | Authorization endpoint. Required for `custom`.                                                                                                                 |
| `--token-endpoint <url>`    | Token endpoint. Required for `custom`.                                                                                                                         |
| `--userinfo-endpoint <url>` | Userinfo endpoint. Required for `custom`.                                                                                                                      |
| `--jwks-uri <url>`          | JWKS URI. Required for `custom`.                                                                                                                               |
| `--sso-name <name>`         | Provider display name. Required for `custom`.                                                                                                                  |

If you omit `--client-secret`, `--client-secret-stdin`, and `--env-file`, and the `sso_client_secret` environment variable isn't set, the CLI prompts for the secret interactively.

### Per-provider requirements

All providers require `--provider`, `--client-id`, and a client secret, provided through `--client-secret`, `--client-secret-stdin`, `--env-file`, the `sso_client_secret` environment variable, or the interactive prompt. Some providers need additional flags:

| Provider    | Additional required flags                                                                     |
| ----------- | --------------------------------------------------------------------------------------------- |
| `google`    | None                                                                                          |
| `microsoft` | `--tenant-id`.                                                                                |
| `github`    | None                                                                                          |
| `okta`      | `--okta-domain`.                                                                              |
| `custom`    | `--sso-name`, `--auth-endpoint`, `--token-endpoint`, `--userinfo-endpoint`, and `--jwks-uri`. |

Microsoft Entra example:

```bash theme={null}
base44 auth sso enable --provider microsoft --client-id <id> --client-secret <secret> --tenant-id <tenant-id>
```

Okta example:

```bash theme={null}
base44 auth sso enable --provider okta --client-id <id> --client-secret <secret> --okta-domain myorg.okta.com
```

Custom OIDC example:

```bash theme={null}
base44 auth sso enable --provider custom \
  --client-id <id> --client-secret <secret> \
  --sso-name "My IdP" \
  --auth-endpoint https://idp.example.com/authorize \
  --token-endpoint https://idp.example.com/token \
  --userinfo-endpoint https://idp.example.com/userinfo \
  --jwks-uri https://idp.example.com/.well-known/jwks.json
```

### Config file format

Instead of passing every value as a flag, provide a JSON file with `--file`. Fields match their flag counterparts in camelCase, and flag values take precedence over file values when both are provided.

```json theme={null}
{
  "provider": "okta",
  "clientId": "your-client-id",
  "clientSecret": "your-client-secret",
  "oktaDomain": "myorg.okta.com"
}
```

## See also

* [`auth password-login`](/developers/references/cli/commands/auth-password-login): Enable or disable email and password login
* [`auth pull`](/developers/references/cli/commands/auth-pull): Fetch auth config from Base44 to your local project
* [`secrets set`](/developers/references/cli/commands/secrets-set): Set project secrets manually
* [Managing login and registration](/Setting-up-your-app/Managing-login-and-registration): Configure login options in the dashboard