# Single sign-on (SSO)

> Let your team sign in through your OIDC identity provider with just-in-time membership.

Source: https://gheima.ma/docs/sso

SSO lets your team sign in to Gheima through your own OpenID Connect (OIDC) identity provider, such as Okta, Microsoft Entra, Google Workspace, Keycloak, or any other OIDC-compliant IdP. When someone signs in at your IdP with an email on your claimed domain, Gheima adds them to your account as a member on their first sign-in.

### Claim your domain

1. **Add a connection** — Enter your OIDC issuer URL, plus the client ID and client secret of an application you register at your IdP. Set its redirect URL to https://gheima.ma/api/sso/callback.
2. **Publish the DNS record** — We generate a TXT record at _gheima-sso.<your-domain>. Add it at your DNS host to prove ownership of the domain, and keep it there: we check it daily, and sign-in through this connection stops if it is missing three days in a row.
3. **Verify** — Once the record is live, verify the connection. It becomes active and your SSO login URL starts working.

### How sign-in works

Members open your SSO login URL and are redirected to your identity provider. After they authenticate, Gheima verifies the returned ID token, confirms the email is on your claimed domain, and creates a session. First-time users are added to your account as members automatically.

```
curl https://api.gheima.ma/v1/sso/connections \
  -H "Authorization: Bearer $GHEIMA_TOKEN" \
  -d '{"emailDomain":"acme.com","issuer":"https://login.acme.com","clientId":"gheima","clientSecret":"…"}'
```

> Note: Only OIDC providers are supported. SSO is included on the Team, Agency, and School plans. The client secret is encrypted at rest, and the API never returns it. New members count against your plan's member limit.

> Result: Your team signs in with your identity provider, and new members are provisioned automatically.

---

All docs: https://gheima.ma/docs.md