Set up Single Sign-On (OIDC)

Reonic supports Single Sign-On via OIDC (OpenID Connect) with Microsoft Entra ID, Okta, Keycloak, Auth0, or any standard OIDC provider. You configure it once under Settings > Company settings > Integrations > OIDC Server, and from then on everyone in your workspace signs in through your identity provider. SSO controls how people sign in. Their roles and permissions stay entirely inside Reonic.

Before you start

• You need admin rights. If you don't see the OIDC Server section under Settings > Company settings > Integrations, contact your Reonic account manager.
• Register an OIDC application in your identity provider and collect three values: the Discovery URL (the …/.well-known/openid-configuration endpoint, must be HTTPS), the Client ID, and the Client Secret.
• Whitelist Reonic's redirect URL in your provider's app: your Portal address followed by /oidc/callback.
• Your provider must support the Authorization Code flow with client-secret (Basic) authentication.
• Create your users in Reonic first. SSO matches people by email, so each person signs in only once a matching Reonic user already exists.

Connect your identity provider

1. Open Settings > Company settings > Integrations > OIDC Server.
2. Enter the Discovery URL, Client ID, and Client Secret.
3. Click Check OIDC parameters. Reonic confirms the required endpoints and auth method and verifies that your Client ID and Secret are accepted. Fix any reported errors before continuing.
4. Click Save configuration (it unlocks once the check passes). From then on, everyone in your workspace signs in through your identity provider.
5. Test it: go to the login page, enter a user's email, confirm you're redirected to your identity provider, sign in, and land back in Reonic.

Pro tip: Enabling SSO is all-or-nothing for the workspace. While it's on, every user is routed through your provider and email login links are unavailable. You can't have some people use SSO and others use email login. Email login returns only when you disable SSO, so roll it out when your whole team is ready.

Manage the connection

• Edit: open the OIDC Server section and choose Edit settings. Re-enter the Client Secret on any change.
• Disable: use the disable toggle and confirm when prompted. Users return to email login links. Re-enabling later means re-entering all credentials.

Things to know

• Login is email-first. Users always type their email, and Reonic routes them to your provider from there.
• Email is the match key. The email your provider returns must match a Reonic user's email exactly. Create the user in Reonic first so the match succeeds.
• SSO handles authentication. Manage users, roles, and permissions in Reonic as usual.
• OIDC only. Reonic supports OIDC. If your requirement mandates SAML 2.0, use OIDC with your provider instead.
• Mobile login. Setup and the main flow live in the web Portal. If mobile field-worker login matters to you, check with your Reonic account manager for the current mobile experience.
• Client-secret hygiene. Reonic asks you to re-enter the Client Secret on any change, so keep your own copy where you store credentials for your provider.

Need help?

• Step-by-step questions about this flow → contact your Reonic account manager.
• Feature requests / something missing → drop a note to your account manager.
• Bug reports → include a screenshot and the URL where it happened in your support email.

Last updated on August 4, 2026