Enterprise SSO

Neuroline uses your verified email domain to select the correct OpenID Connect connection. SSO authenticates users but does not grant organization access: invite each user to the organization before they sign in with SSO.

Prerequisites

Your identity provider must support:

• OpenID Connect discovery over HTTPS
• Authorization Code flow
• PKCE with S256
• client_secret_post token authentication
• the openid, email, and profile scopes

The returned identity must include sub and email. When email_verified is present, it must be true. The email domain must exactly match the domain verified in Neuroline.

1. Verify your domain

1. Open Organization → SSO in the Neuroline dashboard.

2. Enter the domain used in your users' email addresses, without https://.

3. Create the TXT record shown by Neuroline:

   Name:  _neuroline-verification.example.com
   Value: token=<generated value>

4. Wait for DNS propagation, then select Check DNS record.

Changing the domain starts verification again and clears the stored OIDC configuration.

2. Register Neuroline with your identity provider

Create an OIDC web application with:

Redirect URI: https://<your-neuroline-origin>/api/auth/oidc/callback
Flow:         Authorization Code
PKCE:         S256
Scopes:       openid email profile
Token auth:   client_secret_post

For the Neuroline development environment, the redirect URI is:

https://dev.neuroline.ai/api/auth/oidc/callback

Use the issuer URL advertised by your identity provider. It must be HTTPS and must expose a valid OpenID Connect discovery document.

3. Save and test the connection

1. Enter the issuer URL, client ID, and client secret in Neuroline.
2. Save the connection.
3. Sign out and select SSO on the Neuroline login page.
4. Enter an invited user's email address on the verified domain.
5. Complete authentication at the identity provider.

If sign-in fails, first check the redirect URI, issuer URL, client authentication method, returned email domain, and email_verified claim.