Configure SSO

Keycard supports any OIDC identity provider, including Okta and Microsoft Entra ID. Users are provisioned Just-in-Time (JIT) on first login, or ahead of login through SCIM Provisioning.

Requires the Admin organization Role in Keycard and admin access to your identity provider.

For Okta or Microsoft Entra ID, follow one of the guides below:

For any other OIDC identity provider:

1. Copy the Redirect URL

   In Keycard Console, open Settings → Connection and copy the Redirect URL.

2. Create an OIDC application

   In your identity provider, create an OAuth 2.0 / OIDC application:

   Field	Value
   Application type	Web application
   Redirect URI	The Redirect URL from step 1
   Grant types	Authorization Code

   Save the Client ID, Client Secret, and Issuer URL.

3. Link the identity provider to Keycard

   Open Settings → SSO, or use the Keycard Terraform provider. Turn on Enable SSO, then enter the Identifier (the issuer URL), Client ID, and Client Secret from step 2.

   

   Click Save SSO Configuration.

4. Set the launch URL

   To let users sign in from your identity provider’s dashboard, copy the Initiate Login URI from Settings → SSO under Provider Configuration and paste it as the application’s launch URL or home page URL.

5. Test authentication

   Sign in from your identity provider’s dashboard and confirm the User appears under People.

When users log in via SSO for the first time, they join your organization as a Viewer, which is read-only. To let someone manage Keycard, an Admin updates their role on the People page. See Roles & Permissions for details.

To grant access to a team rather than one person at a time, put people in a Group and assign the Role to the Group.

Domain verification enables a seamless login experience at console.keycard.ai.

Without verification: Users access Keycard through your identity provider dashboard (Okta tiles, Microsoft My Apps)

With verification: Users enter their email at console.keycard.ai and are automatically redirected to your identity provider

To request verification, email help@keycard.ai with your organization name and the domain to verify. Keycard will verify you control the domain before enabling this feature.

After verification:

• Users with your verified email address domain must authenticate through your identity provider
• Entering an email with a verified domain automatically redirects to your identity provider

Note: The same domain cannot be reused across multiple organizations.

For emergency access when your identity provider is unavailable, administrators can use this URL:

https://id.keycard.ai/openid/connect/login?tenant=personal&iss=https://id.keycard.ai&target_link_uri=https://console.keycard.ai

This enables non-SSO email/password accounts to authenticate.