---
source_url: "https://workos.com/docs/sso"
title: Single Sign-On – WorkOS Docs
mirrored_at: 2026-09-01T01:32:23.958Z
host: workos.com
cited_in_42a: true
mirror_canonical: "https://index.42a.ai/workos.com/docs/sso"
---

> **Original source:** https://workos.com/docs/sso

## On this page

-   [Choose your integration approach](#choose-your-integration-approach)
    
    -   [AWith the standalone SSO API](#a-with-the-standalone-sso-api)
    -   [BUsing WorkOS AuthKit](#b-using-workos-authkit)
    
-   [How Single Sign-On works](#how-single-sign-on-works)
-   [What you’ll build](#what-you-will-build)
-   [Before getting started](#before-getting-started)
-   [API object definitions](#api-object-definitions)
-   [1Add SSO to your app](#1-add-sso-to-your-app)
    
    -   [Install the WorkOS SDK](#install-the-workos-sdk)
    -   [Set secrets](#set-secrets)
    -   [Add an endpoint to initiate SSO](#add-an-endpoint-to-initiate-sso)
    -   [Add a callback endpoint](#add-a-callback-endpoint)
    
-   [2Configure a redirect URI](#2-configure-a-redirect-uri)
    
    -   [Identity provider-initiated SSO](#identity-provider-initiated-sso)
    
-   [3Test end-to-end](#3-test-end-to-end)

## Choose your integration approach

There are two ways to integrate Single Sign-On (SSO) with WorkOS:

### AWith the standalone SSO API

The standalone API (covered in this document), is a standalone API for integrating into an existing auth stack.

### BUsing WorkOS AuthKit

[AuthKit](https://workos.com/docs/authkit) is a complete authentication platform which includes SSO out of the box.

## How Single Sign-On works

Single Sign-On is the most frequently asked for requirement by organizations looking to adopt new SaaS applications. SSO enables authentication via an organization’s [identity provider (IdP)](https://workos.com/docs/glossary/idp).

This service is compatible with any IdP that supports either the [SAML](https://workos.com/docs/glossary/saml) or [OIDC](https://workos.com/docs/glossary/oidc) protocols. It’s modeled to meet the [OAuth 2.0](https://workos.com/docs/glossary/oauth-2-0) framework specification, abstracting away the underlying authentication handshakes between different IdPs.

![Authentication Flow Diagram](https://images.workoscdn.com/images/90b84f08-3363-446a-8610-f7b2bd2ee2ca.png?auto=format&fit=clip&q=80)

WorkOS SSO API acts as authentication middleware and intentionally does not handle user database management for your application.

## What you’ll build

In this guide, we’ll take you from learning about Single Sign-On and POC-ing all the way through to authenticating your first user via the WorkOS SSO API.

## Before getting started

To get the most out of this guide, you’ll need:

-   A [WorkOS account](https://dashboard.workos.com/)
-   A local app to integrate SSO with.

Reference these [example apps](https://workos.com/docs/sso/example-apps) as you follow this guide.

## API object definitions

[Connection](https://workos.com/docs/reference/sso/connection)

The method by which a group of users (typically in a single organization) sign in to your application.

[Profile](https://workos.com/docs/reference/sso/profile)

Represents an authenticated user. The Profile object contains information relevant to a user in the form of normalized and raw attributes.

## 1Add SSO to your app

Let’s build the SSO authentication workflow into your app.

### Install the WorkOS SDK

WorkOS offers native SDKs in several popular programming languages. Choose a language below to see instructions in your application’s language.

Don't see an SDK you need? [Contact us](mailto:support@workos.com) to request an SDK!

Install the SDK using the command below.

JavaScript

npm install @workos\-inc/node

### Set secrets

To make calls to WorkOS, provide the API key and, in some cases, the client ID. Store these values as managed secrets, such as `WORKOS_API_KEY` and `WORKOS_CLIENT_ID`, and pass them to the SDKs either as environment variables or directly in your app’s configuration based on your preferences.

Environment variables

WORKOS\_API\_KEY\='sk\_example\_123456789'

WORKOS\_CLIENT\_ID\='client\_123456789'

The code examples use your staging API keys when

[signed in](https://dashboard.workos.com/)

### Add an endpoint to initiate SSO

The endpoint to initiate SSO via the WorkOS API is responsible for handing off the rest of the authentication workflow to WorkOS. There are a couple configuration options shown below.

You can use the optional `state` parameter to encode arbitrary information to help restore application state between redirects.

If there is an issue generating an authorization URL, WorkOS will return the redirect URI as is. Read the [API Reference](https://workos.com/docs/reference/sso/get-authorization-url) for more details.

### Add a callback endpoint

Next, let’s add the redirect endpoint which will handle the callback from WorkOS after a user has authenticated with their identity provider. This endpoint should exchange the authorization code returned by WorkOS with the authenticated user’s profile. The authorization code is valid for 10 minutes.

JavaScript

import type { NextApiRequest, NextApiResponse } from 'next';

import { WorkOS } from '@workos-inc/node';

const workos \= new WorkOS(process.env.WORKOS\_API\_KEY);

const clientId \= process.env.WORKOS\_CLIENT\_ID;

export default async (req: NextApiRequest, res: NextApiResponse) \=> {

  const { code } \= req.query;

  const { [profile](https://workos.com/docs/reference/sso/profile) } \= await workos.sso.[getProfileAndToken](https://workos.com/docs/reference/sso/profile/get-profile-and-token)({

    code,

    clientId,

  });

  // Use the Test Organization ID to get started. Replace it with

  // the user's real organization ID when you finish the integration.

  const organization \= 'org\_test\_idp';

  // Validate that this profile belongs to the organization used for authentication

  if (profile.organizationId !== organization) {

    return res.status(401).send({

      message: 'Unauthorized',

    });

  }

  // Use the information in \`profile\` for further business logic.

  res.redirect('/');

};

When adding your callback endpoint, it is important to always validate the returned profile’s organization ID. It’s unsafe to validate using email domains as organizations might allow email addresses from outside their corporate domain (e.g. for guest users).

## 2Configure a redirect URI

In the [Applications](https://dashboard.workos.com/environment/applications) section of the WorkOS Dashboard, open your application and go to the **Redirects** tab to configure allowed redirect URIs. Add your callback endpoint from the previous section.

Multi-tenant apps will typically have a single redirect URI specified. You can set multiple redirect URIs for single-tenant apps. You’ll need to be sure to specify which redirect URI to use in the WorkOS client call to fetch the authorization URL.

More information about wildcard characters support can be found in the [Redirect URIs](https://workos.com/docs/sso/redirect-uris/wildcard-characters) guide.

![Redirects in the Dashboard](https://images.workoscdn.com/images/195dbff3-adbf-4010-b07c-ffc73ceeca68.png?auto=format&fit=clip&q=90)

### Identity provider-initiated SSO

Normally, the default redirect URI you configure for your application is going to be used for all identity provider-initiated SSO sessions. This is because the WorkOS client is not used to initiate the authentication flow.

However, your customer can specify a separate redirect URI to be used for all their IdP-initiated sessions as a `RelayState` parameter in the SAML settings on their side.

Learn more about configuring IdP-initiated SSO in the [Login Flows](https://workos.com/docs/sso/login-flows/idp-initiated-sso/configure-idp-initiated-sso) guide.

## 3Test end-to-end

If you followed this guide, you used the Test Organization available in your staging environment to initiate SSO. With that, you can already test your integration end-to-end.

![Test SSO WorkOS Dashboard](https://images.workoscdn.com/images/7b7407d7-dcc7-4fd4-859f-4ee4214d69c2.png?auto=format&fit=clip&q=80)

Head to the _Test SSO_ page in the [WorkOS Dashboard](https://dashboard.workos.com/) to get started with testing common login flows, or read on about that in detail in the next guide.