Single sign-on

Single sign-on lets your team sign in to TraceX with the same company account they use everywhere else. You control access from one place: when someone leaves and you turn off their account in your identity provider, they lose TraceX too.

TraceX supports OpenID Connect: Okta, Microsoft Entra ID, Google Workspace, Auth0 and others. SSO is part of the Team plan.

Set up

1. In your identity provider, create an OpenID Connect (web) application.

2. In TraceX, open Security → Single sign-on and copy the redirect URI into the application’s allowed redirect URIs.

3. Back in TraceX, enter:

   Field	Where to find it
   Issuer URL	Your provider’s OpenID issuer, e.g. https://acme.okta.com
   Client id	From the application you created
   Client secret	From the application you created
   Email domains	The domains your organization owns, e.g. acme.com

4. Optionally turn on Add new people automatically and choose their role.

Members then sign in with their work email: TraceX finds your organization by the domain and sends them to your provider.

Provider notes

Provider	Issuer URL looks like
Okta	https://acme.okta.com
Microsoft Entra ID	https://login.microsoftonline.com/<tenant id>/v2.0
Google Workspace	https://accounts.google.com
Auth0	https://acme.us.auth0.com/

SSO only

With SSO only, members sign in only through your provider. Admins keep password sign-in, so a provider outage can’t lock the organization out.

Your provider is trusted for two-factor, so TraceX’s two-factor requirement doesn’t apply to SSO-only sign-in. Enforce MFA in your provider instead.

Troubleshooting

Problem	What to check
“Redirect URI mismatch” from your provider	Paste the redirect URI from Security → Single sign-on exactly, with no trailing changes.
People aren’t sent to your provider	Their email domain must be in Email domains.
New people can’t get in	Turn on Add new people automatically, or invite them from Team.