Setting up SSO

LeadForge supports OIDC-based Single Sign-On for any provider that implements the spec — Okta, Azure AD, Google Workspace, Auth0, Keycloak, or a generic OIDC IdP.

Before you start

You'll need to be an Owner of your LeadForge organization. SSO is configured per-organization, not per-user.

Configure the IdP

Create a new OIDC application in your IdP with:

• Redirect URI: https://<your-leadforge-host>/auth/sso/callback
• Scopes: openid email profile

Copy the Client ID, Client Secret, and Discovery URL that your IdP issues.

Configure LeadForge

Open Settings → Security → SSO, paste the three values, pick a provider preset (Okta / Azure / Google / Auth0 / Generic), and click Save. Click Test connection to round-trip a sign-in before you turn it on for everyone.

Provisioning

By default we just-in-time create users on first login. You can optionally restrict to a list of email domains, or require an existing LeadForge invite before SSO will provision an account.