Single Sign-On
Single sign-on (SSO) lets people sign in to APIGIT with your company’s identity provider. APIGIT supports providers that use OpenID Connect (OIDC).
SSO is available on the Enterprise plan. The account owner and account admins can set it up.
Set Up SSO
Setup has four steps: create the integration, register the callback URL with your provider, verify your domain, and ask APIGIT to activate it.
1. Create the Integration
- Navigate to the Billing & Plan page (Plan & Usage for account admins)
- Switch to the SSO Integration (optional) tab
- Click Add SSO Integration
- Fill in the Create SSO (Authentication) dialog and click Create
| Field | What to enter |
|---|---|
| Authentication Types | OAuth2 |
| Authentication Name | A name for this integration, up to 30 characters. It becomes part of the callback URL |
| Email Domain | The email domain of your users, such as acme.example |
| OAuth2 Provider | openidConnect. The OpenID Connect Auto Discovery URL field appears when you choose it |
| Client ID (key) | The client ID from your identity provider |
| Client Secret | The client secret from your identity provider |
| OpenID Connect Auto Discovery URL | The discovery URL of your identity provider. It must start with https:// |
The email domain must be a plain domain name. Public mail domains, such as gmail.com or outlook.com, are refused.
The authentication name and email domain cannot be changed after creation. When you edit an integration, leave Client Secret blank to keep the current secret.
2. Register the Callback URL
The dialog shows a Callback URL under Service Provider Details (APIGit). Copy it into the application you created at your identity provider.
3. Verify Your Domain
Verification proves that your company owns the email domain. The new integration appears in the list with a TXT record to add:
- Add the record to the DNS of the domain itself. Its value has the form
apigit-verify=<token> - Click Verify
DNS changes can take a while. If the record is not found yet, APIGIT tells you so, and you can click Verify again later.
The first account to verify a domain gets it, and pending claims on that domain from other accounts are removed. If the domain is already in use by another account, contact support.
4. Ask APIGIT to Activate It
A new integration starts inactive, and you cannot activate it yourself. The APIGIT team activates it. After verifying your domain, email support@apigit.com with the integration name. Until then, the edit dialog shows the status Pending Review.
Integration Status
| Status | Meaning |
|---|---|
| Pending | The domain has not been verified |
| Verified | The domain is verified, and the integration is not active yet |
| Active | People can sign in with this integration |
| Inactive | The integration has no domain and is not active |
Sign In with SSO
- Open the APIGIT sign-in page and click Sign in with SSO
- Enter your Work email address
- Click Continue with SSO, then sign in at your identity provider
The email address must be in the integration’s domain. Addresses in any other domain are refused, including addresses returned by your identity provider. If the integration is not active, the page shows “SSO is not enabled for your organization.”
An existing password account with the same address is not linked automatically.
Remove an Integration
Click the delete icon in the integration’s row. An integration that people still sign in with cannot be deleted.
If your subscription becomes inactive, SSO management is limited to deletions only, and SSO will be disabled soon.