# Set up single sign-on with your identity provider

Let members sign in to your community with the account they already have, by connecting your OAuth 2.0 or OpenID Connect provider in Brand Control Center.

With SSO configured, the sign-in sheet shows a **Continue with \<your brand>** button next to Google and Apple. It appears on your community site, in the Genuin app, and in your SDK-powered app. A member who taps it is sent to your identity provider, signs in there or is recognised by an existing session, and comes back signed in to the community. Genuin creates the member account from the profile your provider returns and links it to the provider's user id, so the same person gets the same account on every device.

SSO is for brands whose users already have accounts with an OAuth 2.0 or OpenID Connect provider such as Auth0, Okta, Cognito, or Keycloak. If your app has its own session and no OAuth provider, use [Auto Login](https://begenuin.com/developers/developer-resources/sdk/genuin-auto-login) instead; see [Understand user authentication mechanisms in the Genuin SDK](https://begenuin.com/developers/developer-resources/sdk/user-authentication-mechanisms-in-genuin-sdk) for the comparison.

## Before you begin

| Requirement | Detail |
| --- | --- |
| An application at your identity provider | A confidential client that supports the authorization code flow. You need its client ID and client secret. |
| Callback URLs registered with that application | Add Genuin's callback URL for each environment you use. The four URLs are listed under this table. |
| A user info endpoint | Genuin reads the member's profile from your provider's user info endpoint after sign-in. It needs a user id, an email address, and an email-verified flag. |
| Discovery document, if you have one | https://<issuer>/.well-known/openid-configuration. With it, you enter one URL instead of three endpoints. |

Callback URLs:

- Production: `https://api.begenuin.com/api/v4/thirdparty/callback` and `https://nodejs.prod.begenuin.com/api/v4/thirdparty/callback`
- QA: `https://api.qa.begenuin.com/api/v4/thirdparty/callback` and `https://nodejs.qa.begenuin.com/api/v4/thirdparty/callback`

## Configure SSO

1. In Brand Control Center, go to **Settings** > **Setup Single Sign On (SSO)**.
   ![The Setup Single Sign On form in Brand Control Center Settings: Primary Details with CTA Display Name, Client ID, Client Secret, and Third Party ID fields, a Have an OIDC Discovery Endpoint question with Yes and No, and a Scope field holding openid, profile, and email tags.](https://cdn.sanity.io/images/lnrtvsvr/development/d1a3042fd0cefb94fb463b10bf4c26ff77645cdc-1876x912.jpg)
   *Step 1: The SSO form, with the primary details and the discovery choice.*
2. Fill in **Primary Details**:

| Field | What to enter |
| --- | --- |
| CTA Display Name | A name for the sign-in button. Required, although the apps currently label the button Continue with <your brand name>. |
| Client ID | The application's client ID from your provider. |
| Client Secret | The application's client secret. The eye icon shows or hides it while you type. |
| Third Party ID | Optional. The identifier Genuin uses for your provider. Leave it empty to use your community subdomain. |

3. Answer **Have an "OIDC Discovery Endpoint"?**
   - **Yes**: paste the discovery URL into **OIDC Discovery Endpoint**. Genuin reads the authorization, token, and user info endpoints from it.
   - **No**: enter the three endpoints yourself. **Authorization Endpoint** is where the member is sent to sign in; **Token Endpoint** is where Genuin exchanges the code for tokens; **User Info Endpoint** is where it reads the profile. **Authorization Endpoint Query Params** and **Token Endpoint Body Params** take the names of extra parameters your provider expects on those requests.
     ![The SSO form with OIDC discovery set to No: an Authorization Endpoint field, an Authorization Endpoint Query Params box, a Token Endpoint field, and a Token Endpoint Body Params box.](https://cdn.sanity.io/images/lnrtvsvr/development/53a69483eb6bb0a663d4c69ed106bcb2b4d1600b-1877x913.jpg)
     *Step 3: The manual endpoint fields shown when there's no discovery document.*
4. Set **Scope**. `openid`, `profile`, and `email` are always sent; add any scope your user info endpoint needs for the fields you map. Your discovery document lists the scopes it supports under `scopes_supported`.
5. Fill in **User Info Mapping**. Each row maps a Genuin field (**Key**) to the name of the field in your user info response (**Value**). `userid`, `email`, and `emailVerified` are required; for a standard OpenID Connect provider they map to `sub`, `email`, and `email_verified`. Click **New** to map `age`, `bio`, `birthdate`, `country_code`, `gender`, `is_mobile_verified`, or `mobile` as well. For a field inside a nested object, write the path with dots, such as `data.profile.id`.
   ![The User Info Mapping section of the SSO form: a User Info Endpoint field and a Key and Value table with the required rows userid, email, and emailVerified, and a New button to add rows.](https://cdn.sanity.io/images/lnrtvsvr/development/458b882f4847c6e8849ff62251719da6e6773947-1874x911.jpg)
   *Step 5: Mapping the user info response to Genuin's member fields.*
6. Click **Save**. Brand Control Center confirms with "SSO configuration successfully updated." The brand sign-in button appears on your community site and in your apps on their next load.
7. Test it: open your community site, choose to sign in, and click **Continue with \<your brand>**. You're sent to your provider and back, signed in as a member whose email matches the one your provider returned.

## How the sign-in runs

1. The member taps **Continue with \<your brand>**. The app asks Genuin for the authorization URL for your provider and opens it.
2. The member signs in at your provider, or is passed through by an existing provider session.
3. Your provider redirects to Genuin's callback with an authorization code. The callback forwards the code to the page or app the member started from.
4. The app sends the code to Genuin. Genuin exchanges it at your token endpoint, calls your user info endpoint, and applies the mapping.
5. Genuin finds the member by your provider's user id, or creates the account on first sign-in, and starts a session.

Google and Apple sign-in stay available next to your button, and a member can use any of them.

## Limitations

- **One provider per brand.** The form holds a single configuration.
- **Authorization code flow only.** SAML and the implicit flow aren't supported.
- **Mapping reads the user info endpoint**, not the ID token. A claim that exists only in the ID token can't be mapped.
- **Extra parameters are names only.** The query and body parameter boxes take parameter names; their values aren't configurable.
- **The button label is your brand name.** The CTA Display Name is stored but not shown.
- **No test button.** Verify by signing in on the community site after saving.

## See also

- [Understand user authentication mechanisms in the Genuin SDK](https://begenuin.com/developers/developer-resources/sdk/user-authentication-mechanisms-in-genuin-sdk)
- [How Genuin Auto Login works](https://begenuin.com/developers/developer-resources/sdk/genuin-auto-login)
- [Generate an access token with the Authentication API](https://begenuin.com/developers/developer-resources/api/generate-access-token-using-authentication-api)
- [Integrate the Genuin Android SDK](https://begenuin.com/developers/developer-resources/sdk/how-to-integrate-and-power-your-brand-community-in-android-apps)
- [Go-live checklist for your community](https://begenuin.com/developers/get-started/are-you-ready-to-go-to-market-with-your-community)