Resources

Single Sign-On Setup

Connect Breakpoint to the identity provider your organization already uses. OIDC, OAuth 2.0, and SAML 2.0 are supported; most teams are done in under fifteen minutes.

Supported protocols

Pick OIDC when your provider offers it — it gives the strongest token verification.

OpenID Connect (OIDC)

Recommended

Full id_token verification against your IdP’s signing keys, with issuer, audience, and replay (nonce) checks. Works with every major provider.

OAuth 2.0

Supported

Authorization-code flow with the user profile read from your provider’s userinfo endpoint. Use OIDC instead when your provider offers it.

SAML 2.0

Supported

Enterprise SAML federation, brokered through our authentication layer. Contact us to enable SAML for your organization.

The one value every provider needs

https://breakpoint.it.com/api/auth/sso/oauth/callback

Setup flow (all providers)

In Breakpoint, open Dashboard → Organization → Settings → Single Sign-On (organization admin, Professional plan or above).
Toggle Enable SSO and choose your provider type (OIDC for the vendors below).
Paste your Issuer URL and click "Discover from Issuer" — the authorization, token, userinfo, and signing-key endpoints fill in automatically.
Enter the Client ID and Client Secret from your identity provider.
Set Scopes to "openid, email, profile" and list your users’ email domains under Allowed Email Domains — sign-ins from any other domain are rejected.
Save, sign out, and test: on the sign-in page choose "Sign in with SSO" and enter your organization slug.

Provider-specific steps

Exact clicks for the most common identity providers.

Microsoft Entra ID (Azure AD)

In the Entra admin center, go to App registrations → New registration. Choose "Web" as the platform.
Set the redirect URI to https://breakpoint.it.com/api/auth/sso/oauth/callback
Under Certificates & secrets, create a client secret and copy its Value (not the ID).
In Breakpoint, use the tenant-specific issuer: https://login.microsoftonline.com/<tenant-id>/v2.0 — not /common or /organizations, whose tokens cannot pass issuer verification.
Client ID is the app registration’s "Application (client) ID". Click Discover, paste the secret Value, keep scopes "openid, email, profile".
Add your users’ UPN domains (e.g. contoso.com) to Allowed Email Domains.

Entra ID only includes the email claim when the email scope is granted; Breakpoint falls back to the user’s UPN, which still must pass your domain allow-list.

Google (Workspace / Cloud Identity)

In the Google Cloud console, open APIs & Services → Credentials → Create credentials → OAuth client ID, type "Web application".
Add https://breakpoint.it.com/api/auth/sso/oauth/callback under Authorized redirect URIs.
Configure the OAuth consent screen for your Workspace organization (Internal user type keeps it to your domain).
In Breakpoint, set the Issuer to https://accounts.google.com and click Discover.
Paste the OAuth client ID and secret, keep scopes "openid, email, profile".
List your Workspace domains under Allowed Email Domains.

Set the consent screen to "Internal" so only accounts in your Workspace can authenticate.

Okta

In the Okta admin console, create an App Integration: OIDC – OpenID Connect, application type "Web Application".
Set the Sign-in redirect URI to https://breakpoint.it.com/api/auth/sso/oauth/callback
Assign the app to the groups or users who should have access.
In Breakpoint, set the Issuer to your Okta org URL (e.g. https://your-org.okta.com) and click Discover.
Paste the client ID and secret from the app integration, keep scopes "openid, email, profile".
Add your corporate email domains to Allowed Email Domains.

If you use a custom Okta authorization server, use its issuer URL exactly as shown in Okta’s metadata.

Auth0

In the Auth0 dashboard, create an Application of type "Regular Web Application".
Add https://breakpoint.it.com/api/auth/sso/oauth/callback to Allowed Callback URLs.
In Breakpoint, set the Issuer to https://<your-tenant>.auth0.com and click Discover.
Paste the application’s Client ID and Client Secret, keep scopes "openid, email, profile".
Add your email domains to Allowed Email Domains.

Any other OIDC-compliant provider (Ping, OneLogin, Keycloak, JumpCloud…) follows these same steps: register a web app with our redirect URI, then Discover from its issuer.

How Breakpoint verifies SSO sign-ins

Every OIDC sign-in is verified against your provider's published signing keys, including issuer, audience, expiry, and replay protection. The verified email's domain must be on your organization's allow-list, so a misconfigured or hostile provider cannot sign users into someone else's workspace.

Stuck on a provider that isn't listed here? Contact us and we'll walk through it with you. Our security practices are documented on the Security & Compliance page.