Self-serve SSO for OIDC

Your customers can now set up their own OIDC connections. Self-serve SSO lets you delegate enterprise SSO configuration to your customers' IT admins, without giving them Dashboard access. In addition to SAML, it now supports custom OpenID Connect (OIDC) providers.

How it works

The Security tab in <OrganizationProfile /> now has an OpenID Connect (OIDC) group in the provider picker, alongside SAML. An admin with the org:sys_entconns:manage permission selects OIDC Provider and sets up the connection end-to-end:

• Domains: Add one or more domains and verify ownership of each with a DNS TXT record.
• Connection: Create an OIDC application in the identity provider using the authorized redirect URI Clerk displays, then supply the provider's endpoints — a discovery endpoint, or the authorization, token, and user info URLs — along with the client ID and client secret. Clerk reads sub and email from the ID token, and given_name and family_name when the provider sends them.
• Test: Run a test sign-in to confirm the connection works end-to-end.
• Activate: Turn the connection on once the test passes.

The connection is scoped to the Organization it's configured in and behaves like any other enterprise connection once it's live: users with a matching email domain sign in through the configured provider.

Get started

Self-serve SSO is enabled per Organization. In the Clerk Dashboard⁠, select an Organization, open its Settings, and turn on Allow this organization to set up enterprise SSO under Organization permissions. The Security tab then surfaces wherever your app renders <OrganizationProfile />.

For setup details and requirements, refer to the self-serve SSO documentation.