Setting Up Single Sign-On (SSO)

Single Sign-On (SSO) lets your team sign in with an existing account from an identity provider - without having to set a password in awork.

---

Key benefits and use cases

SSO makes signing in simple and consistent:

• Let your team members use their existing identity provider accounts instead of creating a new awork password
• Use modern OpenID Connect login based on OAuth 2.0
• Optionally disable other sign-in methods once SSO is set up

---

How to set up Single Sign-On (SSO)

Choose a supported identity provider

Supported identity providers are:

• Okta (website)
• Auth0 (website)
• Microsoft Entra ID (formerly Azure AD) (website)
• OneLogin (website)
• GSuite (Google IAM: website)
• Keycloak (website)

If your identity provider isn't listed, contact us via support and we'll check if we can connect it.

Set up SSO in awork

1. Go to Settings (gear icon in the bottom left of the main menu) > Integrations
2. Open the Integration Library and select your desired provider
3. Fill in the displayed fields and complete the setup

Enable required redirect URLs

The following redirect URLs must be enabled:

https://app.awork.com/enterprise-login https://app.awork.com/api/v1/accounts/authorize-slack https://app.awork.com/api/v1/accounts/external/{Login Provider Name}
https://app.awork.com/api/v1/accounts/msteams/authorize https://app.awork.com/api/v1/accounts/authorize

Service-specific redirect URLs:

• Web login: https://app.awork.com/enterprise-login
• Slack authorization: https://app.awork.com/api/v1/accounts/authorize-slack
• Microsoft Teams authorization: https://app.awork.com/api/v1/accounts/msteams/authorize
• Zapier: https://app.awork.com/api/v1/accounts/authorize

---

Configure SSO with Okta

1. Open the Okta configuration at YOUR-SUBDOMAIN.okta.com/admin
2. Go to the Applications section in the menu
3. Add a new application and name it, for example, awork
4. Enter the Client ID, Client Secret, and Subdomain into the awork configuration and save by clicking Save

Also set the following in Okta under Login:

1. Initiate login URI: AWORK_SUBDOMAIN.awork.com/login
2. Login redirect URIs: https://app.awork.com/enterprise-login https://app.awork.com/api/v1/accounts/authorize-slack https://app.awork.com/api/v1/accounts/external/okta https://app.awork.com/api/v1/accounts/msteams/authorize https://app.awork.com/api/v1/accounts/authorize

)

---

Configure SSO with Auth0

1. Open the Auth0 configuration
2. Go to the Applications section in the menu
3. Add a new application of type Regular Web Applications and name it, for example, awork
4. Enter the Client ID, Client Secret, and Subdomain into the awork configuration and save
5. Set the following URLs in the Application URLs section:
6. Application login URL: AWORK_SUBDOMAIN.awork.com/login
7. Allowed callback URLs: https://app.awork.com/enterprise-login, https://app.awork.com/api/v1/accounts/authorize-slack, https://app.awork.com/api/v1/accounts/external/auth0, https://app.awork.com/api/v1/accounts/msteams/authorize, https://app.awork.com/api/v1/accounts/authorize
8. Allowed web origins: AWORK_SUBDOMAIN.awork.com app.awork.com

)

)

---

Configure SSO with OneLogin

1. Open the OneLogin configuration at SUBDOMAIN.onelogin.com
2. Go to the Applications section in the menu
3. Add a new application by clicking Add App in the top right, and name it, for example, awork
4. Select OpenID Connect (OIDC) as the type, set the name to, for example, awork, and save
5. In the SSO section, you'll find Client ID and Client Secret. Find the Subdomain in your OneLogin account URL ({Subdomain}.onelogin.com). Enter these values in awork and save
6. Set these URLs in the Configuration section:
7. Login URL: AWORK_SUBDOMAIN.awork.com/login
8. Redirect URIs: https://app.awork.com/enterprise-login https://app.awork.com/api/v1/accounts/authorize-slack https://app.awork.com/api/v1/accounts/external/onelogin https://app.awork.com/api/v1/accounts/msteams/authorize https://app.awork.com/api/v1/accounts/authorize

---

Configure SSO with Microsoft Entra ID (formerly Azure AD)

1. Open the Entra ID configuration in the Azure Portal

2. Click on App registrations in the Manage section of the menu

3. Add a new registration and name it, for example, awork SSO

4. Set Supported account types to Accounts in this organizational directory only (Your Domain - single tenant) and enter https://app.awork.com/enterprise-login as the Redirect URI for the Web platform. Then click Register

   )

5. In the Overview, you'll find the Application (Client) ID (= Client ID in awork) and the Directory (Tenant) ID (= Subdomain in awork)

   )

6. Under Certificates & secrets, you can create a new Client secret and enter the value in awork as the Client Secret.

)

7. Under Authentication, enter the following Redirect URLs for a Web platform:

https://app.awork.com/enterprise-login https://app.awork.com/api/v1/accounts/authorize-slack https://app.awork.com/api/v1/accounts/external/azure https://app.awork.com/api/v1/accounts/msteams/authorize https://app.awork.com/api/v1/accounts/authorize

)

Under Implicit grant and hybrid flows, you must check the box for ID tokens. For Supported account types, you must select Accounts in this organizational directory only (Your Domain - single tenant)

)

The login flow uses the preferred_username claim of the Entra user by default. If you'd like to use UPN instead, you can configure UPN as an optional claim in the Token configuration:

• Token type: ID
• Claim: upn

Then click Add.

)

---

Configure SSO with GSuite (Google IAM)

1. Go to https://console.cloud.google.com/apis/credentials and select your project
2. Click Create Credentials and select OAuth Client ID
3. Select Web application as the type
4. Enter a name, for example, awork
5. Add the following Redirect URIs: https://app.awork.com/enterprise-login https://app.awork.com/api/v1/accounts/authorize-slack https://app.awork.com/api/v1/accounts/external/gsuite https://app.awork.com/api/v1/accounts/msteams/authorize https://app.awork.com/api/v1/accounts/authorize
6. Save by clicking Create
7. On the right, you'll find the Client ID and the Client Secret, which you need to enter in awork

)

)

You can find more information about SSO with GSuite here.

---

Configure SSO with Keycloak

To set up Keycloak SSO via OpenID Connect:

1. Log in to your Keycloak Admin Console

2. Navigate to Clients

3. Download the Client configuration file: Keycloak awork Client Configuration

4. Drag the file into the resource field to import the required settings

5. Save the new client

   )

6. In the Client Details, go to the Credentials tab and copy the Client secret

   )

7. In the Realm Settings, you'll find the .well-known/openid-configuration link at the end of the General settings (OpenID Endpoint Configuration). The URL typically looks like this: https://{your-keycloak-url}/realms/master/.well-known/openid-configuration

   )

8. Contact support with the Client ID, Client Secret, and the .well-known/openid-configuration URL so we can set up the integration for you

---

Configure custom SSO providers (OpenID Connect)

awork also supports other SSO providers that support OpenID Connect.

You'll need the complete OpenID Configuration URL (for example, https://custom-domain.com/.well-known/openid-configuration), the Client ID, and the Client Secret.

---

Sign in via SSO at app.awork.com

1. Go to app.awork.com
2. Select Sign in with SSO
3. Enter your workspace subdomain

You'll be redirected to the SSO login screen or, if you're already logged in, directly to your awork dashboard.

---

Tips and notes

After setup

If the configuration was successful, SSO Sign-in will be available in the login area.

Disable other sign-in methods

Once SSO is configured, you can disable and hide other sign-in methods (email and password as well as social login via Google and Apple).

1. Go to Settings > General.
2. Disable other login options

This is only recommended if no external users work in your workspace who are not managed through identity management.

Global vs. workspace login

If you've disabled email/password and/or social login, these options will still be shown on the global page app.awork.com. They will only be hidden on your workspace page YOUR-WORKSPACE-SUBDOMAIN.awork.com.

Once SSO is configured, Sign in with SSO will also appear on YOUR-WORKSPACE-SUBDOMAIN.awork.com. You'll be redirected to the SSO login screen or directly to your dashboard.

---

Frequently asked questions (FAQs)

Is SSO available in every plan?

No, SSO is only available in the awork Enterprise plan.

Does awork support SAML 2.0?

No. awork does not support SAML 2.0 and uses OpenID Connect based on OAuth 2.0 instead.

Can my identity provider manage permissions, users, or groups in awork?

No. Permissions, users, and groups are not currently managed via the identity provider. SSO only enables sign-in for existing awork user accounts that are matched via email address.

What happens if I remove the SSO settings after disabling other sign-in options?

Email and password login will be automatically re-enabled so you can sign in with your admin account at any time.

Can I set up SSO with Keycloak in the awork web interface?

Not yet. Please contact support to set up Keycloak SSO, as this is not yet possible through the web interface (coming soon).