# OIDC (/security/single-sign-on/oidc) Bitelio works as the relying party (RP) for any OpenID Connect provider — Okta, Azure AD/Entra ID, Google Workspace, or a custom OIDC IdP. ## Register the callback URL In **Settings → SSO**, choose **OIDC** to create the connection. Register its callback URL at your IdP as the app's redirect URI: ``` https:///sso//callback ``` The connection ID is assigned when you create the connection, so create it first, then use the callback URL Bitelio shows you when configuring the app on the IdP side. ## Add your IdP's details Enter the three values your IdP gives you for this app: * **Issuer URL** * **Client ID** * **Client Secret** The client secret is stored encrypted and is write-only — once saved, Bitelio never displays it again. If you need to change it, enter a new one; there's nothing to copy back out. ## Requirements Your IdP must return a verified email claim (`email_verified: true`) on the ID token — Bitelio only trusts the asserted email when the provider itself vouches for it. Under the hood, the login flow uses PKCE and a nonce to protect the authorization code exchange and reject replayed or injected tokens; there's nothing to configure for this, it's on by default. ## Finish setup Set the connection's **default role** for first-time logins, and optionally turn on **`allowUnverifiedDomains`** if you want brand-new users to be provisioned before their domain is verified. Then enable the connection. ## What's next The alternative protocol, if your IdP prefers SAML 2.0. Domain verification, JIT provisioning, and how sign-in is initiated.