Single sign-on
Let your team sign in to the dashboard with Okta, Microsoft Entra ID, Google Workspace or any OpenID Connect provider. Single sign-on is included in the Scale and Enterprise plans, and in every self-hosted server.
1. Create an app at your provider
Create an OpenID Connect web application with:
| Sign-in redirect URI | https://api.healkite.com/v1/auth/sso/callback (self-hosted: <your URL>/v1/auth/sso/callback) |
| Grant type | Authorization code (PKCE is used automatically) |
| Scopes | openid email profile |
Copy the issuer URL, client ID and client secret.
| Provider | Issuer URL |
|---|---|
| Okta | https://<your-org>.okta.com (or your custom authorization server) |
| Microsoft Entra ID | https://login.microsoftonline.com/<tenant-id>/v2.0 |
| Google Workspace | https://accounts.google.com |
| Auth0 | https://<tenant>.auth0.com/ |
| Keycloak | https://<host>/realms/<realm> |
2. Connect it in Healkite
Owners and admins: Team → Single sign-on → Set up SSO. Paste the issuer, client ID and secret, and choose what happens to people from your domain who weren't invited:
- Can't sign in: only people you invite by email get in.
- Join as Viewer / Developer / Admin: anyone your provider lets through joins with that role.
The client secret is encrypted at rest and never shown again.
3. Verify your email domain
Add your domain (for example acme.com), then create the TXT record Healkite shows at your DNS provider:
_healkite.acme.com TXT "healkite-verify=…"Press Check record. Only verified domains route sign-ins, so no other organization can send your colleagues to their provider. Public email providers such as gmail.com can't be added.
Signing in
On the sign-in page, choose Continue with SSO and enter a work email. Healkite sends you to your provider and back. Sessions last seven days.
Invites and roles
Invite people by work email under Team to give them a specific role before their first sign-in. Change roles any time; removing a member ends their sessions right away. Access keys for CI and the MCP server are separate and unaffected.
Turning it off
Team → Single sign-on → Turn off removes the provider and domains. Members who joined through SSO stay in the team but can't sign in until SSO is on again; GitHub members are unaffected.