auth sso

Configure Single Sign-On (SSO) so end users can sign in to your app through an external identity provider. Supported providers are Google, Microsoft, GitHub, Okta, and any custom OIDC-compliant provider. SSO and social login are mutually exclusive. Enabling SSO disables any active social login providers, and enabling a social login provider disables SSO. This command updates your local auth config and immediately saves the provider credentials to Base44’s secrets store. The SSO toggle itself is applied to your deployed app only after you run auth push or deploy.

Usage

Enable SSO with a provider’s OAuth credentials:

base44 auth sso enable --provider google --client-id <id> --client-secret <secret>

Disable SSO:

base44 auth sso disable

Arguments

Argument	Description	Required
`<enable\|disable>`	Whether to enable or disable SSO.	Yes

Flags

All flags below apply to enable. disable takes no flags. Required flags depend on the provider, see Per-provider requirements.

Flag	Description
`--provider <provider>`	SSO provider: `google`, `microsoft`, `github`, `okta`, or `custom`.
`--client-id <id>`	OAuth client ID.
`--client-secret <secret>`	OAuth client secret.
`--client-secret-stdin`	Read the client secret from stdin.
`--env-file <path>`	Read the client secret from a `.env` file. The file must contain a `sso_client_secret` key. Cannot be combined with `--file`.
`--file <path>`	JSON config file with all SSO settings, see Config file format. Flag values override file values. Cannot be combined with `--env-file`.
`--scope <scope>`	OAuth scope. Defaults to `openid email profile` for OIDC providers and `user:email` for GitHub.
`--discovery-url <url>`	OIDC discovery URL. Derived automatically for `google`, `microsoft`, and `okta`.
`--tenant-id <id>`	Microsoft Entra tenant ID. Required for `microsoft`.
`--okta-domain <domain>`	Okta domain, such as `myorg.okta.com`. Required for `okta`.
`--auth-endpoint <url>`	Authorization endpoint. Required for `custom`.
`--token-endpoint <url>`	Token endpoint. Required for `custom`.
`--userinfo-endpoint <url>`	Userinfo endpoint. Required for `custom`.
`--jwks-uri <url>`	JWKS URI. Required for `custom`.
`--sso-name <name>`	Provider display name. Required for `custom`.

If you omit --client-secret, --client-secret-stdin, and --env-file, and the sso_client_secret environment variable isn’t set, the CLI prompts for the secret interactively.

Per-provider requirements

All providers require --provider, --client-id, and a client secret, provided through --client-secret, --client-secret-stdin, --env-file, the sso_client_secret environment variable, or the interactive prompt. Some providers need additional flags:

Provider	Additional required flags
`google`	None
`microsoft`	`--tenant-id`.
`github`	None
`okta`	`--okta-domain`.
`custom`	`--sso-name`, `--auth-endpoint`, `--token-endpoint`, `--userinfo-endpoint`, and `--jwks-uri`.

Microsoft Entra example:

base44 auth sso enable --provider microsoft --client-id <id> --client-secret <secret> --tenant-id <tenant-id>

Okta example:

base44 auth sso enable --provider okta --client-id <id> --client-secret <secret> --okta-domain myorg.okta.com

Custom OIDC example:

base44 auth sso enable --provider custom \
  --client-id <id> --client-secret <secret> \
  --sso-name "My IdP" \
  --auth-endpoint https://idp.example.com/authorize \
  --token-endpoint https://idp.example.com/token \
  --userinfo-endpoint https://idp.example.com/userinfo \
  --jwks-uri https://idp.example.com/.well-known/jwks.json

Config file format

Instead of passing every value as a flag, provide a JSON file with --file. Fields match their flag counterparts in camelCase, and flag values take precedence over file values when both are provided.

{
  "provider": "okta",
  "clientId": "your-client-id",
  "clientSecret": "your-client-secret",
  "oktaDomain": "myorg.okta.com"
}

Get Started

Commands

Usage

Arguments

Flags

Per-provider requirements

Config file format

See also

​Usage

​Arguments

​Flags

​Per-provider requirements

​Config file format

​See also

Usage

Arguments

Flags

Per-provider requirements

Config file format

See also