Core Concepts
Enterprise SSO
Connect your camelAI organization to Google Workspace, Microsoft Entra ID, Okta, Auth0, or another OpenID Connect provider.
Enterprise SSO lets people sign in to a camelAI organization through your identity provider. camelAI supports OpenID Connect (OIDC), including Google Workspace, Microsoft Entra ID, Okta, and Auth0.
SSO is available on the Enterprise plan. Organization owners and admins can configure and manage it.
Before you start
You need:
- Permission to create an OAuth or OIDC client in your identity provider
- Owner or admin access to your camelAI organization
- A regular user account in your identity provider for testing
Choose who can join
The Allow uninvited SSO users setting controls whether an identity provider login can create a member without a camelAI invitation.
| Setting | What happens on the first SSO sign-in |
|---|---|
| Off | Existing organization members and users with an active invitation can sign in. An invited user is created automatically with the role and workspace access selected in the invitation. |
| On | Any user allowed by the identity provider and camelAI domain rules can join. camelAI creates them as a regular member with access to the first active workspace. |
Leaving this setting off is the more controlled option. Invite each person from your organization Team settings, then send them the SSO sign-in URL. They do not need to create a password-based camelAI account or accept the invitation link first. Their verified SSO login consumes the invitation.
Configure your identity provider
Start in camelAI under Settings → Organization → Single sign-on. Copy the callback URL shown on the page and use it exactly in your identity provider. It normally looks like:
https://camelai.dev/api/auth/enterprise-oidc/callbackChoose your provider below. camelAI uses the issuer, client credentials, token authentication method, and email claim. It automatically discovers the authorization, token, user info, and signing-key endpoints.
Configure the consent screen
Open the Google Auth Platform in a Google Cloud project owned by your organization.
Set the app audience to Internal so only users in your Google Workspace organization can authorize it.
Create a web OAuth client
Create an OAuth client with the application type Web application. Add the camelAI callback URL under Authorized redirect URIs. You can leave Authorized JavaScript origins blank.
Google may take a few minutes to apply a newly added redirect URI.
Enter the connection in camelAI
Copy the client ID and client secret, then use:
| camelAI field | Value |
|---|---|
| Issuer URL | https://accounts.google.com |
| Token endpoint authentication | Client secret POST |
| Email claim | |
| Allowed email domains | Leave blank for the first test, or enter your exact Workspace domain |
camelAI requests the openid, email, and profile scopes. It does
not request access to Gmail, Drive, or other Workspace data.
Test and enable SSO
Test the connection
Click Test connection and complete the provider login with a regular organization user.
camelAI checks the discovery document, authorization and token endpoints, signing keys, token exchange, and returned email. Google Workspace tests also verify the email and hosted domain.
The test does not create a user, link an account, or enable SSO.
Enable SSO
When every connection check passes, click Enable SSO.
camelAI shows an organization-specific sign-in URL. Test it in a private browser window before sharing it with your team or adding it to your internal app launcher.
Allowed email domains
Allowed domains are an additional camelAI-side boundary. They protect the organization if the identity provider application is accidentally assigned too broadly or its policy changes later.
Enter domains without @, for example:
example.comFor Google Workspace, camelAI also requires a verified email and a matching
Google hosted-domain (hd) claim.
Add and remove users
Add a user
If uninvited users are not allowed:
- Invite the exact email address from your camelAI Team settings.
- Choose the user's organization role and workspace access.
- Send the user your organization-specific SSO sign-in URL.
The first successful SSO login creates the account, consumes the invitation, applies its access, and signs the user in.
If uninvited users are allowed, permit the user in your identity provider and send them the same SSO sign-in URL. No camelAI invitation is required.
Remove a user
Remove the member from the camelAI organization and disable or unassign them in your identity provider. Removing the camelAI membership revokes that organization's SSO access even if the provider still authenticates the user.
To restore a removed user, send a new invitation to the exact same email. Their next SSO login restores the membership with the new invitation's role and workspace access.
Troubleshooting
Security notes
- camelAI binds each login to the provider's stable OIDC subject, not email alone.
- The provider must return the configured email claim. Google Workspace logins must also include a verified email and matching hosted domain.
- Invitation-gated account creation requires an active invitation for the exact asserted email.
- New SSO-created accounts are scoped to the organization.
- SSO sessions are restricted to the organization that issued them.
- Client secrets are encrypted at rest and are never shown again after saving.