SSO / Single Sign-On

Single sign-on (SSO) lets your team use one set of credentials — the same ones they use for email, Slack, and other tools — to sign in to Obvious. Instead of managing separate passwords, everyone authenticates through your identity provider (like Okta, Azure AD, or Google Workspace). One login, one place to manage access. Workspace Admins on a Team plan or above can set up SSO by configuring an OIDC application in their identity provider and then registering it in Settings → Workspace → Single Sign-On.

What you need before you start

Workspace Admin access in Obvious
Team plan or above — SSO is available on Team plan and above. It also requires the feature to be enabled for your workspace — contact help@obvious.ai if you're on a Team plan and don't see the SSO option.
An identity provider that supports OIDC — Okta, Azure AD (Entra ID), Google Workspace, OneLogin, Auth0, and most providers that support OpenID Connect work with Obvious
Four things from your identity provider: Issuer URL, Client ID, Client Secret, and (optionally) a Discovery Endpoint

Note: Obvious uses the OpenID Connect (OIDC) protocol for SSO. If your provider only supports SAML, check whether it also offers an OIDC option — most do.

Set up SSO

SSO setup involves two places: your identity provider (Okta, Azure AD, etc.) and Obvious. You or your IT team create the OIDC application in your identity provider — the Obvious agent can't do that part for you. But the agent can help you prepare.

Tip: Ask the agent to help you identify the required fields, confirm redirect URIs, and sanity-check your configuration values before you enter them. Try something like: "Help me prepare the SSO values I need for Okta" — the agent walks you through what to gather and validates what you've got.

Step 1: Create an OIDC application in your identity provider

In your identity provider's admin console, create a new OIDC (OpenID Connect) application. You'll need to set the redirect URI to https://api.app.obvious.ai/auth/sso/callback/<provider-id> — replacing <provider-id> with the Provider ID you'll enter when you add the provider in Obvious (Step 2). For example, a Provider ID of acme-okta gives the redirect URI https://api.app.obvious.ai/auth/sso/callback/acme-okta. Each SSO provider has its own redirect URI. Once the app is created, note the following values:

Issuer URL — usually something like https://login.acme.com/realms/main or https://accounts.google.com
Client ID
Client Secret
Discovery Endpoint (optional — most providers auto-discover this from the Issuer URL)

Your identity provider's documentation has specific steps for creating OIDC applications. If you're not sure where to find these values, ask the agent — it can help you figure out what to look for based on your provider.

Step 2: Add the provider in Obvious

Open Settings → Workspace → Single Sign-On.
Click Add SSO Provider. A window opens with the following fields.
Enter a Provider ID — a short, unique name for this connection (for example, acme-okta). The Provider ID becomes part of the redirect URI you set in Step 1. It must be unique across all of Obvious, and it can't be changed after the provider is created — to use a different one, delete the provider and add it again.
Enter your company's Email Domain (for example, acme.com). Anyone who signs in with an email address on this domain will be routed through SSO.
Enter the OIDC Issuer URL from your identity provider.
Enter the Client ID and Client Secret from the OIDC application you created in Step 1.
Optionally, enter the Discovery Endpoint and JWKS Endpoint. Most providers auto-discover these from the Issuer URL, but you can specify them explicitly if needed.
Leave Enable PKCE checked — it's on by default and recommended for most providers.
Click Add Provider.

Your provider appears in the SSO settings list with a Disabled badge and an Unverified badge. Both are expected — you'll enable it after verifying your domain.

Verify your domain

Before SSO goes live, Obvious needs to confirm that you own the email domain you entered. This prevents someone from claiming a domain they don't control.

In the SSO provider card, click Verify Domain.
Obvious gives you a DNS TXT record — a Host/Name and a Value. Click Copy to copy the value.
Add this TXT record to your domain's DNS settings. (Your IT team or domain registrar can help with this if you're not sure how.)
Wait for the DNS record to propagate. This can take anywhere from a few minutes to 48 hours.
Come back to Settings → Workspace → Single Sign-On and click Check Verification.
Once verified, the badge changes to Domain Verified.

The verification record is valid for 7 days — if verification doesn't succeed within that window, click Verify Domain to generate a fresh one.

Tip: If verification seems stuck, ask the agent to help you troubleshoot — it can sanity-check your TXT record values and flag common formatting issues like trailing periods or incorrect hostnames.

Enable SSO

After your domain is verified:

Click Enable on your SSO provider card.
The badge changes to Enabled. Members with email addresses on that domain are now routed through your identity provider when they sign in.

Enabling a provider before its domain is verified has no effect — sign-ins only route through a provider once its domain is verified.

What changes for your team

Sign-in flow — When a team member with a matching email domain signs in to Obvious, they're redirected to your identity provider. They authenticate there, then land back in Obvious. No separate Obvious password needed.
New members — Anyone with a verified domain email can sign in through SSO — their Obvious account is created automatically on first sign-in, and they'll receive an email verification message. Signing in with SSO doesn't add them to your workspace, though: invite them to the workspace, or enable Domain Auto-Join so they can join on their own (see below).
Existing members — Members who already have Obvious accounts continue as normal. Their next sign-in routes through SSO instead of email and password.
Non-matching domains — Members whose email addresses don't match the SSO domain (contractors, consultants, partners) still sign in the usual way. SSO only applies to the domain you configured.

Note: Deleting a provider immediately restores standard sign-in — members who have an Obvious password can use it right away, and members who only ever signed in with SSO can set a password through the reset flow on the sign-in page. Keep a copy of your provider details before deleting: provider configuration can't be edited after creation, so re-creating the provider means re-entering everything.

Let members join automatically with Domain Auto-Join

Instead of inviting each person, you can let anyone with your company's email domain join the workspace on their own:

Open Settings → Workspace → Domain Access.
Under Domain Auto-Join, enter your company's email domain (for example, acme.com) and click Add.
Anyone who signs in with an email address on that domain can now join the workspace themselves — they'll see it listed as a workspace they can join, and joining adds them as a workspace member.

Domain Auto-Join works independently of SSO — it applies to anyone signing in with a matching email domain, however they sign in. Public email domains like gmail.com can't be used. Remove a domain at any time to stop new joins; to keep specific individuals out, block their email address under Blocked Emails on the same page.

Managing SSO providers

From Settings → Workspace → Single Sign-On, you can:

Enable or disable a provider without deleting it — useful for testing or temporary rollbacks
Delete a provider entirely — users on that domain lose SSO access and fall back to standard sign-in
Add multiple providers for different domains if your organization uses more than one identity provider. Each provider needs its own email domain, and each email domain can be claimed by only one workspace across Obvious.

Note: Provider configuration can't be edited after creation — the Issuer URL, Client ID, Client Secret, and Email Domain are fixed. To change any of them, delete the provider and add a new one.

If something isn't working

"Failed to fetch SSO providers" — Check that you're a Workspace Admin. SSO settings require admin access. This error can also mean SSO isn't enabled for your workspace (contact help@obvious.ai if you're on a Team plan and don't see the SSO option), or that the request failed due to a network or server issue.

Domain verification stuck — DNS propagation can take up to 48 hours. If it's been longer, double-check the TXT record values match exactly — including any trailing periods your DNS provider may add. Verification records expire after 7 days — if yours is older, click Verify Domain to generate a fresh one.

Users not redirected to SSO — Confirm the provider is Enabled (not just added), its domain is verified, and the email domain matches exactly. SSO only routes users whose email domain matches the one you configured.

Identity provider rejects the connection — Verify that the Issuer URL, Client ID, and Client Secret are correct. Check that the redirect URI in your identity provider exactly matches https://api.app.obvious.ai/auth/sso/callback/<provider-id> — including your Provider ID in the path.

Still stuck? — Ask the agent to help you troubleshoot. Describe the error or symptom and it can help you narrow down the issue. For anything it can't resolve, contact help@obvious.ai.

Next steps

Roles & Permissions — Control what team members can access after they sign in
Audit Logs — Track sign-in activity and workspace changes
Workspace Settings — Manage other workspace-level configuration