Single Sign-On
Let your team sign in to Talkr through your own identity provider — Okta, Azure AD/Entra ID, Google Workspace, and any other OpenID Connect provider.
The Single Sign-On section, under Settings → Security, connects your organization to your own identity provider so your team signs in through it instead of a Talkr-specific password. This uses the industry-standard OpenID Connect (OIDC) protocol.
SAML is not supported yet. If your identity provider only offers SAML, submit a request anyway and let us know — we track SAML demand and will reach out if it becomes available.
Supported identity providers
Any identity provider that speaks OpenID Connect works, including:
- Okta
- Microsoft Entra ID (Azure AD)
- Google Workspace
- Auth0
- Keycloak
- Ping Identity
How it works
- Your IT administrator registers Talkr as an application in your identity provider and shares the resulting credentials with us (see below).
- We configure your organization for SSO.
- From then on, anyone with a matching work-email domain can sign in from the Sign in with SSO link on your Talkr login page by entering their email — they're redirected to your identity provider to authenticate, then returned to Talkr already signed in.
- Existing members can keep using their current sign-in method alongside SSO — connecting SSO doesn't remove any other way of signing in.
New members who sign in via SSO for the first time are automatically added to your organization as a member. Nobody is granted admin or owner access through SSO alone — role changes are a separate, explicit step your organization's admins take.
Requesting SSO
Requesting and viewing SSO status requires the permission to manage organization members (held by Owners and Admins).
- Go to Settings → Security → Single Sign-On.
- Enter your identity provider's name and a contact email for your IT administrator.
- Submit the request. Our team will reach out to your contact to exchange the actual credentials — this isn't a self-serve toggle, since it requires registering Talkr as a real application in your identity provider first.
What we'll ask your IT administrator for
To connect your identity provider, we need:
| Value | What it is |
|---|---|
| Issuer URL | Your identity provider's OIDC issuer, e.g. https://your-org.okta.com |
| Client ID | Issued when you register Talkr as an application in your identity provider |
| Client secret | Issued alongside the client ID — keep this confidential |
| Allowed email domain(s) | The work-email domain(s) your organization uses, e.g. yourcompany.com |
In return, we'll give your administrator the redirect URI to register on Talkr's application entry in your identity provider — it will look like:
https://<your-talkr-url>/api/v1/auth/sso/callbackRegistering an application for OIDC in Okta, Azure AD, or Google Workspace normally takes a few minutes on your side — consult your identity provider's own documentation for the exact steps, since the process differs slightly per provider.
Once you're connected
The Single Sign-On section shows your connection status, identity provider name, and registered email domain(s) once it's live:
- Your team members go to the Talkr login page and choose Sign in with SSO.
- They enter their work email.
- They're redirected to your identity provider's own sign-in page.
- After authenticating there, they're returned to Talkr already signed in — no Talkr-specific password involved.
Security
- The redirect URI is fixed and specific to your identity provider registration — Talkr never accepts a login on behalf of your organization from anywhere else.
- Every sign-in is verified against your identity provider's published signing keys, and the returned email is checked against your organization's registered domain(s) before access is granted.
- Talkr never sees or stores your identity provider's own login credentials — authentication happens entirely on your identity provider's side.