Single sign-on (SSO)

Connect your identity provider so your team signs in with their existing corporate accounts. API Stash supports per-workspace OpenID Connect (OIDC) SSO.

Connect your identity provider

A workspace owner sets up SSO in Workspace settings → Single sign-on. SSO works with any standard OIDC provider, including Okta, Microsoft Entra ID (Azure AD), Google Workspace, Auth0, and others. Enter:

• The OIDC issuer URL.
• The client ID.
• The client secret.
• Optionally, an email domain (for example example.com).

Configure the redirect URL

The settings screen shows a redirect / callback URL for your connection. Copy it into your identity provider's list of allowed redirect URIs so the IdP will return users to API Stash after they authenticate.

How members sign in

Members sign in by entering their work email on the login screen and clicking Sign in with SSO. If you configured an email domain for the connection, matching addresses are routed to your provider automatically.

New users are just-in-time provisioned into the workspace on their first login — there's no need to invite them ahead of time.

Security of the connection

The client secret is encrypted at rest, and only workspace owners can view or change the SSO connection. For everything else about how we protect your data, see Security.