Enterprise SSO

Neuroline uses your verified email domain to select the correct OpenID Connect connection. SSO authenticates users but does not grant organization access: invite each user to the organization before they sign in with SSO.

Prerequisites

Your identity provider must support:

• OpenID Connect discovery over HTTPS
• Authorization Code flow
• PKCE with S256
• client_secret_post token authentication
• the openid, email, and profile scopes

The returned identity must include sub and email. When email_verified is present, it must be true. The email domain must exactly match the domain verified in Neuroline.

1. Verify your domain

1. Open Organization → SSO in the Neuroline dashboard.

2. Enter the domain used in your users' email addresses, without https://.

3. Create the TXT record shown by Neuroline:

   Name:  _neuroline-verification.example.com
   Value: token=<generated value>

4. Wait for DNS propagation, then select Check DNS record.

Changing the domain starts verification again and clears the stored OIDC configuration.

2. Register Neuroline with your identity provider

Create an OIDC web application with these settings:

Use the issuer URL advertised by your identity provider. It must be HTTPS and must expose a valid OpenID Connect discovery document.

3. Save and test the connection

1. Enter the issuer URL, client ID, and client secret in Neuroline.
2. Save the connection.
3. Sign out and select SSO on the Neuroline login page.
4. Enter an invited user's email address on the verified domain.
5. Complete authentication at the identity provider.