Security and Team Management
SSO with Auth0
Configure Auth0 as an OIDC SSO provider for dFlow.
Use this walkthrough to fill out Account → Single Sign-On → Add OIDC for Auth0.
1. Create an application in Auth0
- Open the Auth0 Dashboard.
- Go to Applications → Applications → Create Application.
- Choose a name (for example
dFlow SSO) and type Regular Web Application. - Open the app Settings and set:
| Field | Value |
|---|---|
| Allowed Callback URLs | {your-dflow-url}/api/auth/sso/callback/<provider-id> — pick the Provider ID in dFlow first (for example acme-auth0) |
| Allowed Logout URLs | Optional; your dFlow origin if you want Auth0 logout redirects |
| Allowed Web Origins | Your dFlow origin (for example https://app.dflow.sh) |
- Save changes.
- Copy Domain, Client ID, and Client Secret.
2. Issuer URL
Use your Auth0 tenant domain as the issuer:
https://<your-tenant>.auth0.com/For custom domains, use https://<your-custom-auth-domain>/ instead.
3. Fill in the dFlow modal
| Field | Value |
|---|---|
| Provider ID | Same suffix as the Auth0 callback URL (for example acme-auth0) |
| Email domains | Domains your Auth0 users sign in with |
| Issuer URL | https://<your-tenant>.auth0.com/ |
| Client ID | from Auth0 |
| Client secret | from Auth0 |
| Scopes | openid email profile |
| Token auth method | client_secret_basic (or client_secret_post if required) |
| Use PKCE | On |
| Skip discovery | Off |
Auth0 publishes discovery at https://<your-tenant>.auth0.com/.well-known/openid-configuration, so leave endpoint overrides blank.
4. Save and test
- Click Add provider.
- Sign out of dFlow.
- Enter an email on a registered domain.
- Complete Auth0 sign-in and confirm you return to dFlow signed in.
Tips
- Enable the email claim on the ID token if your Auth0 Actions or Rules strip profile claims; dFlow needs a stable email to match domains.
- If you use an Auth0 Organization, ensure the users who should reach dFlow are members of that Organisation and can complete the authorisation flow.