# Single Sign-On OIDC Integration

If you have an Enterprise account in Row Zero, you can configure single sign-on (SSO) via [OpenID  
Connect (OIDC)](https://openid.net/developers/how-connect-works/) using your organization's existing  
SSO provider (Okta, etc.). Every SSO platform uses slightly different terminology when configuring  
an SSO integration, so don't hesitate to contact us for help when you are configuring your provider.

Row Zero is configured to use the OpenID Connect authorization code flow for single sign-on  
(`response_type=code`). We request the `openid profile email` scopes, which are enabled by default  
for most SSO platforms.

Here is the information that you will need to configure a new Row Zero application for single  
sign-on:

1. Sign-in redirect URL or Authorized Redirect URL:
    - `https://auth.rowzero.io/login/callback`
2. Sign-out redirect URL:
    - `https://rowzero.com/logout`
3. Initiate login URL (for users to log in to Row Zero through your provider, e.g. by clicking on a  
Row Zero tile in Okta):
    - `https://rowzero.com/startlogin?connection=<CONNECTION_NAME>`
    - **Note:** You will need to replace `CONNECTION_NAME` above with an identifier that Row Zero  
will provide. Contact us when you are setting up your SSO integration and we will give you the  
`CONNECTION_NAME` to use.

Once you have configured a Row Zero application in your platform, contact us at Row Zero so that we  
can finish configuring the SSO integration on our end.

This is the information that we will need from you:

1. The OpenID Connect metadata URL for the application (typically ends in  
`/.well-known/openid-configuration`)
2. The Client ID for the application
3. The Client Secret for the application. **Do not share this via email or other unsecured means.**  
We will give you a secure way to provide your secret.