> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anny.co/llms.txt
> Use this file to discover all available pages before exploring further.

# OpenID Connect (OIDC) SSO

> anny supports company logins via OpenID Connect. Our support team currently handles the setup.

anny supports company logins via OpenID Connect (OIDC). Any identity provider that offers OpenID Connect Discovery works, for example Entra ID, Okta, Keycloak, Auth0, or Authentik.

You only provide the address of your identity provider and the credentials of the application. anny reads all other endpoints automatically, even if your identity provider changes them later.

<Note>
  Setting this up yourself in the admin area is not possible yet. Write to us at [support@anny.co](mailto:support@anny.co) and we create the connection for you.
</Note>

<Info>
  If your identity provider supports SAML 2.0, we recommend that path, as more features such as SCIM and federated logins are available. You find a guide under [Generic SAML 2.0 SSO](/en/generic-saml-sso).
</Info>

## What we need from you

Create a new application in your identity provider, sometimes also called "client" or "app". It has to be confidential, meaning it works with a client secret. Then send us these three values:

| Value             | Description                                                                               |
| ----------------- | ----------------------------------------------------------------------------------------- |
| **Issuer URL**    | The base address of your identity provider, for example `https://login.example.com/anny`. |
| **Client ID**     | The identifier of the application.                                                        |
| **Client secret** | The matching secret. anny stores it encrypted.                                            |

## What you get from us

Once the connection exists, we come back to you with:

* the **callback URL** that you add to your identity provider as an allowed redirect URL;
* a **post-logout URL**, in case your users should also be signed out of your identity provider when they log out.

<Warning>
  As long as the callback URL is not stored in your identity provider, the login fails with an error such as "redirect\_uri mismatch".
</Warning>

## Requirements for your identity provider

anny requests the scopes `openid profile email` and expects these claims:

| Claim                          | Purpose                                                                                                        |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------- |
| `sub`                          | Permanent identifier of the person. The value has to stay stable, even when the name or email address changes. |
| `email`                        | Used to match the person to their anny account.                                                                |
| `given_name` and `family_name` | First and last name. If your identity provider only sends `name`, that is enough as well.                      |
| `email_verified`               | Optional. If your identity provider reports `false` here, anny rejects the login.                              |

## Related articles

<Columns cols={2}>
  <Card title="SSO overview" href="/en/sso-overview">
    Which login methods anny supports and when each one fits.
  </Card>

  <Card title="Attribute mapping" href="/en/attribute-mapping">
    Automatically assign users to communities based on what your identity provider sends.
  </Card>
</Columns>