> ## Documentation Index
> Fetch the complete documentation index at: https://infisical.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth0 OIDC

> Learn how to configure Auth0 OIDC for Infisical SSO.

<Info>
  Auth0 OIDC SSO is a paid feature. If you're using Infisical Cloud, then it is
  available under the **Pro Tier**. If you're self-hosting Infisical, then you
  should contact [sales@infisical.com](mailto:sales@infisical.com) to purchase a self-hosted license to use
  it.
</Info>

<Note>
  SSO authentication requires [Email Domain Verification](/documentation/platform/email-domain).
  You must verify your organization's email domain before users can log in via SSO.
</Note>

<Steps>
  <Step title="Setup application in Auth0">
    1.1. From the Application's Page, navigate to the settings tab of the Auth0 application you want to integrate with Infisical.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/auth0-oidc/application-settings.png" alt="OIDC auth0 list of applications" />

    1.2. In the Application URIs section, set the **Application Login URI** and **Allowed Web Origins** fields to `https://app.infisical.com` and the **Allowed Callback URL** field to `https://app.infisical.com/api/v1/sso/oidc/callback`.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/auth0-oidc/application-uris.png" alt="OIDC auth0 create application uris" />

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/auth0-oidc/application-origin.png" alt="OIDC auth0 create application origin" />

    <Info>
      If you’re self-hosting Infisical, then you will want to replace [https://app.infisical.com](https://app.infisical.com) with your own domain.
    </Info>

    Once done, click **Save Changes**.

    1.3. Proceed to the Connections Tab and enable desired connections.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/auth0-oidc/application-connections.png" alt="OIDC auth0 application connections" />
  </Step>

  <Step title="Retrieve Identity Provider (IdP) Information from Auth0">
    2.1. From the application settings page, retrieve the **Client ID** and **Client Secret**

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/auth0-oidc/application-credential.png" alt="OIDC auth0 application credential" />

    2.2. In the advanced settings (bottom-most section), retrieve the **OpenID Configuration URL** from the Endpoints tab.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/auth0-oidc/application-urls.png" alt="OIDC auth0 application oidc url" />

    Keep these values handy as we will need them in the next steps.
  </Step>

  <Step title="Finish configuring OIDC in Infisical">
    3.1. Back in Infisical, head to the **Single Sign-On (SSO)** page and select the **General** tab. Click **Connect** for **OIDC**.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/connect-oidc.png" alt="OIDC SSO Connect" />

    3.2. For configuration type, select **Discovery URL**. Then, set **Discovery Document URL**, **JWT Signature Algorithm**, **Client ID**, and **Client Secret** from step 2.1 and 2.2.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/auth0-oidc/org-update-oidc.png" alt="OIDC auth0 paste values into Infisical" />

    <Info>
      Currently, the following JWT signature algorithms are supported: RS256, RS512, HS256, and EdDSA
    </Info>

    Once you've done that, press **Update** to complete the required configuration.
  </Step>

  <Step title="Enable OIDC in Infisical">
    Enabling OIDC allows members in your organization to log into Infisical via Auth0.

    <img src="https://mintlify.s3.us-west-1.amazonaws.com/infisical/images/sso/enable-oidc.png" alt="OIDC auth0 enable OIDC" />
  </Step>

  <Step title="Enforce OIDC SSO in Infisical">
    Enforcing OIDC SSO ensures that members in your organization can only access Infisical
    by logging into the organization via Auth0.

    To enforce OIDC SSO, you're required to test out the OpenID connection by successfully authenticating at least one Auth0 user with Infisical.
    Once you've completed this requirement, you can toggle the **Enforce OIDC SSO** button to enforce OIDC SSO.

    <Warning>
      We recommend ensuring that your account is provisioned using the application in Auth0
      prior to enforcing OIDC SSO to prevent any unintended issues.
    </Warning>

    <Info>
      In case of a lockout, an organization admin can use the [Admin Login Portal](https://infisical.com/docs/documentation/platform/sso/overview#admin-login-portal) in the `/login/admin` path e.g. [https://app.infisical.com/login/admin](https://app.infisical.com/login/admin).
    </Info>
  </Step>
</Steps>

<Tip>
  If you are only using one organization on your Infisical instance, you can configure a default organization in the [Server Admin Console](../admin-panel/server-admin#default-organization) to expedite OIDC login.
</Tip>

<Note>
  If you're configuring OIDC SSO on a self-hosted instance of Infisical, make
  sure to set the `AUTH_SECRET` and `SITE_URL` environment variable for it to
  work:

  <div class="height:1px;" />

  * `AUTH_SECRET`: A secret key used for signing and verifying JWT. This
    can be a random 32-byte base64 string generated with `openssl rand -base64
      32`.

  <div class="height:1px;" />

  * `SITE_URL`: The absolute URL of your self-hosted instance of Infisical including the protocol (e.g. [https://app.infisical.com](https://app.infisical.com))
</Note>