> For the complete documentation index, see [llms.txt](https://docs.silkline.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.silkline.ai/configuration/sso-configuration.md).

# SSO Configuration

Configure Single Sign-On for Silkline with Azure AD (OIDC), Google Workspace, or Okta Workforce as your identity provider

## Overview

Silkline authenticates users through its own identity service at `auth.silkline.ai`. Your identity provider (IdP) connects to that service as an upstream OpenID Connect provider: users click **Sign in** in Silkline, Silkline hands them to your IdP, and your IdP returns them to Silkline once they have authenticated.

Every SSO setup therefore needs two things from Silkline:

* **A redirect URI** (also called a callback URL or sign-in redirect URI) that you register in your IdP. It is specific to your organization.
* **A trusted origin** — the Silkline authentication host — for IdPs that require one, such as Google Workspace.

## Silkline URLs

| Value                  | Production                                                          | Test / Gov                                                                  |
| ---------------------- | ------------------------------------------------------------------- | --------------------------------------------------------------------------- |
| Application            | `https://app.silkline.ai`                                           | `https://dev-app-gov.silkline.ai`                                           |
| Authentication host    | `https://auth.silkline.ai`                                          | `https://dev-auth-gov.silkline.ai`                                          |
| Issuer                 | `https://auth.silkline.ai/realms/silkline`                          | `https://dev-auth-gov.silkline.ai/realms/silkline`                          |
| Redirect URI (per org) | `https://auth.silkline.ai/realms/silkline/broker/<org-id>/endpoint` | `https://dev-auth-gov.silkline.ai/realms/silkline/broker/<org-id>/endpoint` |

{% hint style="info" %}
`<org-id>` is your organization's Silkline ID. Silkline shows the full redirect URI for your organization in **Settings → Single sign-on**, ready to copy — use that value rather than assembling it by hand. See [Self-service SSO setup](/configuration/sso-configuration/self-service-sso.md).
{% endhint %}

{% hint style="warning" %}
Register the URLs for the environment you are connecting to. Most customers only need the production column — use the test / Gov column only if Silkline has directed you to that environment.
{% endhint %}

## Two ways to set up SSO

{% tabs %}
{% tab title="Self-service" %}
An organization admin creates the connection directly in Silkline: pick your IdP, follow the on-screen steps, and paste in your client ID, client secret, and issuer. Silkline provisions the connection immediately.

See [Self-service SSO setup](/configuration/sso-configuration/self-service-sso.md).
{% endtab %}

{% tab title="Assisted" %}
You configure the application in your IdP, then send the resulting values to your Silkline point of contact, who completes the connection and tells you when it is ready to test.

Use the guide for your IdP below.
{% endtab %}
{% endtabs %}

## Guides

* [Self-service SSO setup](/configuration/sso-configuration/self-service-sso.md)
* [Azure AD (OIDC)](/configuration/sso-configuration/azure-ad-oidc.md)
* [Google Workspace](/configuration/sso-configuration/google-workspace.md)
* [Okta Workforce Enterprise](/configuration/sso-configuration/okta-workforce-enterprise.md)

## Domain scoping

An SSO connection applies to the email domains registered for your organization (for example `your-company.com`). Silkline verifies each domain before a connection can be created, so sign-ins from addresses outside those domains are not routed to your IdP. Contact <support@silkline.ai> to add or change your domains.