Login SSO (OIDC)

Let your employees sign in via your company's single sign-on (Microsoft Entra, Google or Okta).

How it works

An employee goes to Sign in → "Sign in with your company SSO" and enters their work email address. HeyOtto recognizes the domain and redirects to your identity provider (IdP). After a successful sign-in, the user — if not already present — automatically created in your environment (within your licence seats).

HeyOtto never moves an existing account from one company to another. SSO only works within domains that you allow.

Set up (Owner)

Open Integrations → "Use your own Microsoft/Google app (advanced)" and at the bottom of the block, fill in Login SSO (OIDC) in:

  1. Issuer-URL of your IdP, for example: 
    Microsoft Entra:  https://login.microsoftonline.com/<tenant-id>/v2.0
Google:           https://accounts.google.com
Okta:             https://<jouw-domein>.okta.com
  2. Client ID and Client secret of an OIDC app you register with your IdP.
  3. Allowed email domains (space- or comma-separated), e.g. bedrijf.be vt-invest.be.
  4. Check Enable SSO on and save.

At your IdP

Register a web/OIDC app with the redirect-URI that's on the HeyOtto page, e.g. https://app.heyotto.eu/auth/sso/callback, and the scopes openid email profile.

Just-in-time users

If JIT on, new employees are automatically created on their first SSO login (with the role "User"). If your licence is full, the sign-in is refused until you free up or purchase extra seats.

Next: Frequently asked questions →