Let your people sign in to Verity with your organisation's identity provider: Microsoft Entra ID (Azure AD), Okta, Google Workspace, or any provider that supports OpenID Connect (OIDC).
You set it up yourself in Verity, in about 15 minutes.
At a glance
Protocol | OpenID Connect (OIDC) |
Grant type | Authorization Code |
Scopes |
|
Redirect URL |
|
Values Verity needs | Issuer URL, Client ID, Client secret |
Where in Verity | Settings → Company profile → Single sign-on (SSO) |
What you need
Admin access to your identity provider, enough to create an app (an "app registration" in Azure Entra).
A Verity administrator account with permission to manage the organisation. The SSO settings are under Settings → Company profile → Single sign-on (SSO).
Your company email domain or domains, e.g.
acme.com.
How it works
A person types their work email on the Verity login page and clicks Continue with SSO.
Verity sends them to your identity provider to sign in (with MFA, if you require it).
Your provider sends them back to Verity with their verified email address.
Verity signs them in to your organisation.
SSO doesn't create accounts. SSO doesn't create Verity accounts or give anyone access by itself. People still need to be invited to your organisation in Verity, so signing in through your provider alone isn't enough.
Step 1: Create an app in your identity provider
In Verity, open Settings → Company profile → Single sign-on (SSO) and copy the Redirect URL with the Copy button. For Verity production it is:
https://ww-coach-production.firebaseapp.com/__/auth/handler
Then follow the steps for your provider.
Microsoft Entra ID (Azure AD)
In the Azure portal, open Microsoft Entra ID → App registrations → New registration.
Set Name to something recognisable, for example
Verity SSO.Set Supported account types to Accounts in this organizational directory only.
Set Redirect URI to platform Web, with the Redirect URL from Verity.
Click Register. On the Overview page, copy the Application (client) ID (this is your Client ID) and the Directory (tenant) ID (you need it for the Issuer URL).
Open Certificates & secrets → New client secret. Add a description, choose an expiry and click Add. Copy the secret's Value right away, because Azure only shows it once. This is your Client secret.
Open API permissions and make sure the app has the Microsoft Graph delegated permissions
openidandemail. If your tenant doesn't let users consent to apps themselves, click Grant admin consent.
Your Issuer URL is:
https://login.microsoftonline.com/<Directory (tenant) ID>/v2.0
Important: every user needs an email address in Entra ID. Azure includes the user's Email (mail) attribute in the sign-in. If it's empty, which happens for some accounts without a mailbox, that person can't sign in with SSO. Check this under Users → (user) → Properties → Contact information → Email.
Optional: to limit who can use the app, open Enterprise applications → (your app) → Properties and set Assignment required to Yes. Then assign the users or groups who should have access.
Okta
In the Okta admin console, open Applications → Create App Integration.
Choose OIDC - OpenID Connect, then Web Application.
Set Grant type to Authorization Code.
Set Sign-in redirect URIs to the Redirect URL from Verity.
Under Assignments, add the people or groups who should use Verity.
Save. On the General tab, copy the Client ID and Client secret.
Your Issuer URL is your Okta domain:
https://acme.okta.com
If you use a custom authorization server, use its issuer instead:
https://acme.okta.com/oauth2/default
Google Workspace
In Google Cloud Console, open APIs & Services → Credentials → Create credentials → OAuth client ID. If prompted, set up the consent screen as Internal.
Set Application type to Web application.
Set Authorized redirect URIs to the Redirect URL from Verity.
Copy the Client ID and Client secret.
Your Issuer URL is:
https://accounts.google.com
Any other OIDC provider
Create a web application with the Authorization Code flow, add the Redirect URL from Verity, and allow the openid and email scopes.
The Issuer URL is the address that serves /.well-known/openid-configuration, without that suffix. For example:
Discovery document: https://idp.example.com/.well-known/openid-configuration Issuer URL: https://idp.example.com
Step 2: Fill in the SSO settings in Verity
Open Settings → Company profile → Single sign-on (SSO).
Field | What to enter |
Redirect URL | Read-only. Copy it into your identity provider (Step 1). |
Name shown to users | A friendly name for your sign-in, e.g. |
Email domains | Your company email domains, separated by commas, e.g. |
Issuer URL | From Step 1. Must start with |
Client ID | From Step 1. |
Client secret | From Step 1. Required the first time. Afterwards it shows Saved. Leave blank to keep it. Only fill it in again to replace the secret. |
Turn on SSO | Tick to switch SSO on. Untick to switch it off without losing your settings. |
Turn off password login | Optional. See Step 4. |
Click Save SSO settings.
About the Email domains field
Your own domain: you can add the domain of your own email address.
More domains: to add a domain you don't have an email on, e.g. a second brand's domain, ask Verity support to add it for you.
Not accepted: free email domains such as
gmail.comoroutlook.com, and domains another organisation already uses.
About the Client secret
Where it's kept: Verity stores it securely with its sign-in service and never shows it again, even to administrators.
Before it expires: create a new secret in your identity provider, paste it into this field and save.
Watch the expiry date. If the client secret expires, SSO sign-in stops working until you paste in a new one.
Step 3: Test it
Sign out of Verity.
On the login page, type your work email and click Continue with SSO.
Sign in with your identity provider. You should land back in Verity, signed in.
The first time, an existing Verity account is connected to SSO automatically. You keep your history and your access.
Step 4 (optional): Turn off password login
Once SSO works, you can require it for everyone on your domains.
Sign in with SSO first. Signing in with Continue with SSO proves SSO works before anyone loses their password, so the option stays locked until you do.
Turn it on. Tick Turn off password login for @yourdomain emails and save.
When it's on:
Passwords stop working. People on your domains can't sign in with a password; they're asked to use SSO. Password-reset emails aren't sent to them.
People are signed out. Anyone signed in with a password is signed out and asked to sign in again with SSO. You, the administrator saving the change, stay signed in.
Other domains are unaffected. Members on domains you didn't list keep their passwords.
To undo it, untick the box and save. Passwords work again straight away.
Inviting people
Invite people the usual way: Settings → Users → Add members.
When SSO is on and the invitee's email is on your domains, the invitation only asks for their name, not a password. After accepting, they click Continue with SSO to sign in.
Troubleshooting
Message | What it means and what to do |
This SSO login isn't set up for your organisation. | Usually one of three things. Check that the person is invited to your organisation in Verity, their email is on one of your listed domains, and SSO is turned on. |
Your organisation requires you to sign in with SSO. | Password login is off for this domain. Use Continue with SSO. |
Your organisation's SSO didn't share your email address with Verity. | Your provider didn't send the person's email. In Azure, check the app has the |
This account can't be connected to your organisation's SSO. | The person isn't an active member yet (accept the invitation first), or their account is already connected to a different SSO. It can also mean the Issuer URL or Client ID doesn't match the app. |
Your identity provider shows a redirect or "reply URL" error | The Redirect URL in your provider doesn't exactly match the one shown in Verity. Copy it again. |
SSO worked before and suddenly stopped | The client secret has probably expired. Create a new one and paste it into the Client secret field. |
Still stuck? Contact Verity support with your organisation name and the exact error message.