OIDC
Configure OpenID Connect single sign-on
Bitelio works as the relying party (RP) for any OpenID Connect provider — Okta, Azure AD/Entra ID, Google Workspace, or a custom OIDC IdP.
Register the callback URL
In Settings → SSO, choose OIDC to create the connection. Register its callback URL at your IdP as the app's redirect URI:
https://<api-host>/sso/<connection-id>/callbackThe connection ID is assigned when you create the connection, so create it first, then use the callback URL Bitelio shows you when configuring the app on the IdP side.
Add your IdP's details
Enter the three values your IdP gives you for this app:
- Issuer URL
- Client ID
- Client Secret
The client secret is stored encrypted and is write-only — once saved, Bitelio never displays it again. If you need to change it, enter a new one; there's nothing to copy back out.
Requirements
Your IdP must return a verified email claim (email_verified: true) on the ID token — Bitelio only trusts the asserted email when the provider itself vouches for it. Under the hood, the login flow uses PKCE and a nonce to protect the authorization code exchange and reject replayed or injected tokens; there's nothing to configure for this, it's on by default.
Finish setup
Set the connection's default role for first-time logins, and optionally turn on allowUnverifiedDomains if you want brand-new users to be provisioned before their domain is verified. Then enable the connection.